Documentation
What Orbit can access
This tab lists the access Orbit holds, how it's granted and how to revoke it. The canonical statement of Orbit's access is here; the rest of this documentation refers back to it.
- Read-only. Every permission Orbit holds is a read-only Microsoft Graph scope. It cannot create, change or delete anything in your tenant; Microsoft enforces that at the token level, not Orbit's code. The one non-Graph source is public DNS: the email authentication checks read your domains' published SPF, DKIM and DMARC records, which requires no permission at all.
- Admin sign-in only. Reports are available to accounts holding an administrator role — Global Administrator, Global Reader, Security Administrator or Security Reader. Any other account is rejected at sign-in.
- Consent granted once, revocable at any time. A Global Administrator consents during onboarding; that standing consent is what lets Orbit read the tenant on each health check without asking again. To revoke it: Microsoft Entra admin centre → Enterprise applications → Orbit → Delete. Access stops immediately. You don't need to contact Planet IT.
Permissions Orbit requests
Each scope is the least-privileged read permission for the reports it feeds.
| Permission | Access | What it's used for |
|---|---|---|
Application.Read.All |
Read-only | Read app registrations and their credentials to check for expired or expiring secrets and certificates. |
AuditLog.Read.All |
Read-only | Read sign-in activity and authentication-method registration to flag inactive accounts, MFA gaps and unusual sign-in locations. |
DeviceManagementApps.Read.All |
Read-only | Read Intune mobile application protection (MAM) policies. |
DeviceManagementConfiguration.Read.All |
Read-only | Read Intune device configuration profiles, compliance policies, security baselines, endpoint security and update policies. |
DeviceManagementManagedDevices.Read.All |
Read-only | Read Intune-managed device inventory, compliance, sync and encryption state. |
DeviceManagementServiceConfig.Read.All |
Read-only | Read Intune device enrollment configuration. |
Directory.Read.All |
Read-only | Resolve user, group and role names, and read directory settings such as password protection and consent configuration. |
Organization.Read.All |
Read-only | Read your organization's display name and hybrid status. |
Policy.Read.All |
Read-only | Read Conditional Access policies, authentication methods and consent policies. |
Reports.Read.All |
Read-only | Read Microsoft 365 usage reports (Teams and SharePoint site activity, Exchange mailbox usage and Copilot usage) to flag dormant and externally-shared content. |
SecurityEvents.Read.All |
Read-only | Read your Microsoft Secure Score, shown on the dashboard beside Orbit's own score. |
SensitivityLabels.Read.All |
Read-only | Read the tenant's Microsoft Purview sensitivity labels to check content classification is in place. |
SharePointTenantSettings.Read.All |
Read-only | Read the tenant's SharePoint and OneDrive settings: external sharing, device sync and session controls. |
Exactly what Orbit keeps
This tab lists everything Orbit stores about your organisation, why, and for how long; there is nothing beyond this table. All of it lives encrypted at rest in Planet IT's Azure storage in the UK (UK South region), keyed by your tenant ID, and is readable only by your organisation's signed-in admins and Planet IT's operators.
| What | Exactly what's kept | Why & how long |
|---|---|---|
| Access record | Your sign-in domain, Microsoft tenant ID, plan status (trial, active or suspended), and first- and last-sign-in timestamps. | Identifies who may use Orbit and manages your trial or subscription. Kept for the life of the relationship; deleted on request. |
| Daily score history | One snapshot per day of your score numbers: the per-hub scores, the overall (e.g. “Intune: 74”) and your licensed-user count. Never the findings, settings or configuration behind them. | Draws the trend on the History page and shows Planet IT your latest overall score. Deleted on request. |
| Report snapshots | The configuration and usage data behind your reports, exactly as read from Microsoft Graph: policies, settings, device inventory, licence and usage reports, and the user, group and app details your reports list. | Serves your reports at sign-in instead of re-querying Microsoft each time. A snapshot serves for up to 24 hours (30 minutes if a source couldn't be fully read), is replaced on each refresh, and is deleted 30 days after its last refresh — immediately if you leave the service. The Refresh button always bypasses it and reads live. |
| Assessment run archive | One scored run per day: each check's name, result (pass, partial, absent or not licensed), severity and summary note, plus the report scores. Never the raw configuration values, and never the user, device or app lists behind a finding — those exist only in the short-lived report snapshots above. | Powers the run comparison and drift detection on the History page. Each day's run is deleted 12 months after it's written — immediately if you leave the service, and on request. |
| Nothing else | No credentials or passwords, and no email, file or chat content — Orbit's permissions cannot read them. | See the Permissions tab for the full scope list. |
Your browser also holds a session copy of report content and score numbers (a signed cookie plus session storage) so pages don't re-fetch as you navigate; it expires with your session. Revoking Orbit's consent (see the Permissions tab) stops all reading at the source.
A printable one-page version of this disclosure, written for security reviews and data-protection records, is at Data-handling statement. To have your stored assessment data deleted, ask Planet IT — snapshots and score history are removed in one step.
How scoring works
Orbit evaluates roughly 130 checks across eight hubs — Entra ID, Intune, Teams, SharePoint, Exchange, Purview, Copilot and Licensing — against Microsoft's recommended configuration for each workload. What every check inspects, and where to fix it, is on the Checks tab; how checks map to CIS and Cyber Essentials is on the Frameworks tab.
Check results
| Result | Meaning | Points earned |
|---|---|---|
| pass | Meets the recommended configuration. | Full points |
| partial | The right control exists but is narrower or weaker than recommended. | Half points |
| absent | The control is missing. | None |
| not licensed | Your licences don't include this feature (e.g. Entra ID P2 risk policies on a Business Premium tenant). Shown for reference and excluded from scoring entirely — you're never penalised for something your tier can't buy. | Excluded |
Severity weighting
Points within each report are shared out in proportion to severity, so a critical check moves the score four times as far as a low one; every report totals 100.
| Severity | Weight | Typically |
|---|---|---|
| critical | ×4 | Identity takeover and data-exposure controls: MFA coverage, legacy authentication, admin count, encryption, anonymous sharing. |
| high | ×3 | Strong hardening: phishing-resistant methods, risk policies, email authentication, endpoint security policies. |
| medium | ×2 | Governance: expiry policies, guest governance, update profiles. |
| low | ×1 | Hygiene: naming policies, empty groups, dormant content. |
Effort labels
| Label | Meaning |
|---|---|
| Quick fix | A settings toggle in the admin centre — minutes. |
| Moderate | A policy that needs planning, piloting or a rollout — days. |
| Project | A structural change (e.g. separating admin accounts) — weeks. |
Check reference
Every check Orbit runs: what it inspects, why it matters, exactly what Orbit reads to evaluate it, and where to fix it. Severity, effort and framework chips match the ones in your reports. Expand a check for its full entry.
Entra ID
Conditional Access
Require MFA for all users critical Moderate CIS 5.2.2.2 CE · User access control
Description
Checks that every user must prove their identity with a second factor when signing in. Technically: an enabled Conditional Access policy includes all users and all applications and grants access only with MFA (or an authentication strength).
Rationale
Accounts without enforced MFA fall to a single guessed, phished or leaked password; Microsoft attributes the overwhelming majority of account compromises to exactly this gap.
Audit
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled policy scoped to All users with an MFA grant. Pass when it also covers all applications; partial when scoped narrower (or when Security Defaults provide the equivalent). A policy targeting “all users” via a group rather than the All keyword isn't recognised — a known false positive.
Remediation
Microsoft Entra admin centre → Protection → Conditional Access → Policies → create a policy: All users, All resources, Grant → Require multifactor authentication. Open the admin centre.
Block legacy authentication critical Quick fix CIS 5.2.2.3 CE · User access control
Description
Checks that old sign-in protocols that can't do MFA are blocked. Technically: an enabled Conditional Access policy targets the legacy client-app types (Exchange ActiveSync and other clients) with a Block grant.
Rationale
Legacy authentication bypasses MFA entirely and is the most common initial-access vector in Microsoft 365 compromises — password-spray campaigns target it specifically.
Audit
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled block policy whose client-app conditions are exactly the legacy types. Pass when scoped to All users (Security Defaults also count); partial when narrower.
Remediation
Microsoft Entra admin centre → Protection → Conditional Access → Policies → create a policy: All users, Conditions → Client apps → Exchange ActiveSync clients + Other clients, Grant → Block access. Open the admin centre.
Phishing-resistant MFA for admins high Moderate CIS 5.2.2.5
Description
Checks that administrator sign-ins require credentials that can't be phished. Technically: an enabled Conditional Access policy targets directory roles and grants access via an authentication strength.
Rationale
Admin accounts are the highest-value phishing targets, and standard MFA prompts can be relayed or fatigued; FIDO2 and certificate-based credentials can't be replayed by a phishing site.
Audit
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled policy with role-based inclusions. Pass when it grants via an authentication strength; partial when it requires only standard MFA. Orbit doesn't verify the strength selected is the phishing-resistant one.
Remediation
Microsoft Entra admin centre → Protection → Conditional Access → Policies → target Directory roles → Grant → Require authentication strength → Phishing-resistant MFA. Open the admin centre.
Emergency access accounts excluded medium Quick fix CIS 1.1.2
Description
Checks that break-glass accounts are excluded from the policies that could lock everyone out. Technically: every enabled Conditional Access policy applying to all users carries user or group exclusions.
Rationale
A tenant whose every admin is caught by a misconfigured MFA or block policy has no way back in — recovery means a support case measured in days, during which nothing can be administered.
Audit
Orbit reads GET /identity/conditionalAccess/policies and checks each broad (all-users) policy for exclusions. Pass when all have them; partial when only some do. Any exclusion counts — Orbit can't verify the excluded account is a genuine break-glass account.
Remediation
Microsoft Entra admin centre → Protection → Conditional Access → Policies → exclude a dedicated emergency-access account (cloud-only, strong credential, monitored) from each broad policy. Open the admin centre.
Secure security-info registration high Moderate CIS 5.2.2.10
Description
Checks that setting up MFA methods is itself protected. Technically: an enabled Conditional Access policy targets the “Register security information” user action and requires MFA.
Rationale
If security-info registration is unprotected, an attacker with a stolen password can enrol their own MFA method — turning your MFA into their MFA.
Audit
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled policy whose user actions include urn:user:registersecurityinfo with an MFA grant. Pass or absent — no partial tier.
Remediation
Microsoft Entra admin centre → Protection → Conditional Access → Policies → target User actions → Register security information → Grant → Require MFA. Open the admin centre.
Require MFA for guests high Quick fix CE · User access control
Description
Checks that external guest users face MFA like everyone else. Technically: an enabled Conditional Access policy requiring MFA targets guests and external users (an all-users MFA policy also satisfies this).
Rationale
Guest accounts authenticate against your tenant with the security posture of somebody else's — without your MFA requirement, their compromised home-tenant password becomes your problem.
Audit
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled MFA policy scoped to GuestsOrExternalUsers or All users. Pass or absent.
Remediation
Microsoft Entra admin centre → Protection → Conditional Access → Policies → target Guest or external users → Grant → Require MFA. Open the admin centre.
Approved app / app protection on mobile medium Moderate
Description
Checks that mobile access to company data is only allowed through apps the organisation controls. Technically: an enabled Conditional Access policy grants access on the approved-app or app-protection-policy control.
Rationale
Without it, any mail client on any phone can sync corporate mailboxes — outside app protection, selective wipe and data-transfer controls.
Audit
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled policy granting via approvedApplication or compliantApplication. Pass when its platform condition covers Android and iOS; partial when no mobile platform condition is set.
Remediation
Microsoft Entra admin centre → Protection → Conditional Access → Policies → Conditions → Device platforms → Android/iOS, Grant → Require approved client app or app protection policy. Open the admin centre.
Require MFA for device registration medium Quick fix
Description
Checks that joining a device to the directory requires MFA. Technically: an enabled Conditional Access policy targets the “Register or join devices” user action with an MFA grant.
Rationale
If device registration is unauthenticated beyond a password, an attacker can register a device they control and use it to satisfy device-based trust elsewhere.
Audit
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled policy whose user actions include urn:user:registerdevice with an MFA grant. Pass or absent.
Remediation
Microsoft Entra admin centre → Protection → Conditional Access → Policies → target User actions → Register or join devices → Grant → Require MFA. Open the admin centre.
Sign-in risk policy (high-risk sign-ins) high Moderate CIS 5.2.2.7
Description
Checks that suspicious sign-ins are automatically challenged. Technically: an enabled Conditional Access policy has sign-in risk levels configured and responds with MFA or block. Requires Entra ID P2.
Rationale
Identity Protection flags sign-ins from anonymised networks, impossible travel and leaked credentials in real time — but without a policy attached, the detection is a log entry, not a defence.
Audit
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled policy with non-empty signInRiskLevels and an MFA or block grant. Shown as not licensed (and excluded from scoring) on tenants without P2.
Remediation
Microsoft Entra admin centre → Protection → Conditional Access → Policies → Conditions → Sign-in risk → High (and Medium), Grant → Require MFA or Block. Open the admin centre.
User risk policy (high-risk users) high Moderate CIS 5.2.2.6
Description
Checks that accounts Microsoft believes are compromised are automatically remediated. Technically: an enabled Conditional Access policy has user risk levels configured and responds with password change, MFA or block. Requires Entra ID P2.
Rationale
A high user-risk score means Microsoft has evidence the account's credential is compromised — typically found in a breach dump. Without a policy, that account keeps working until a human notices.
Audit
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled policy with non-empty userRiskLevels granting password change, MFA or block. Not licensed (and excluded) without P2.
Remediation
Microsoft Entra admin centre → Protection → Conditional Access → Policies → Conditions → User risk → High, Grant → Require password change. Open the admin centre.
Password Management
Password expiration disabled (no forced expiry) medium Quick fix CIS 1.3.1 CE · User access control
Description
Checks that users aren't forced to change passwords on a timer. Technically: every verified domain's passwordValidityPeriodInDays is set to never expire.
Rationale
Forced rotation produces predictable increments (Password1 → Password2) and more helpdesk resets, not more security; Microsoft and NCSC guidance both say expiry should be off when MFA and banned-password checks are in place.
Audit
Orbit reads passwordValidityPeriodInDays per verified domain from GET /domains. Pass when all domains never expire passwords; absent when any forces expiry.
Remediation
Microsoft 365 admin centre → Settings → Org settings → Security & privacy → Password expiration policy → set passwords to never expire. Open the admin centre.
Microsoft global banned password list medium Quick fix CE · User access control
Description
Records that Microsoft's global banned-password list applies to cloud accounts. Technically: Entra ID evaluates every cloud password change against Microsoft's global list; this cannot be disabled.
Rationale
The global list blocks the passwords attackers try first. This check is informational — it always passes for cloud accounts — and anchors the two configurable checks beside it.
Audit
Not read from the tenant: the global list is always on for cloud accounts, so Orbit records a pass.
Remediation
Nothing to do — see the custom banned list and on-premises protection checks for the configurable parts. Open the admin centre.
Custom banned password list configured low Quick fix CIS 5.2.3.2 CE · User access control
Description
Checks that the organisation blocks its own predictable passwords — company name, products, local sports teams. Technically: the Password Rule Settings directory setting has EnableBannedPasswordCheck true and a non-empty BannedPasswordList.
Rationale
Attackers seed password sprays with the company name and variations; the global list can't know your brand words, so without a custom list those remain valid passwords.
Audit
Orbit reads the Password Rule Settings values from GET /groupSettings. Pass when the check is enabled with a populated list; partial when only one of the two is set; absent when neither.
Remediation
Microsoft Entra admin centre → Protection → Authentication methods → Password protection → Custom banned password list. Open the admin centre.
On-premises password protection set to Enforced medium Moderate CIS 5.2.3.3 CE · User access control
Description
Checks that banned-password rules also apply to on-premises Active Directory password changes. Technically: EnableBannedPasswordCheckOnPremises is true with BannedPasswordCheckOnPremisesMode set to Enforce. Evaluated only for hybrid tenants.
Rationale
In a hybrid tenant, AD is where most passwords are actually set; protection that stops at the cloud leaves the primary password store accepting the passwords the cloud bans.
Audit
Orbit reads the Password Rule Settings values from GET /groupSettings, and GET /organization to detect hybrid sync. Pass when enforced; partial when enabled in audit mode only; absent when off. Skipped for cloud-only tenants.
Remediation
Microsoft Entra admin centre → Protection → Authentication methods → Password protection → set Mode to Enforced (requires the on-premises agents deployed on domain controllers). Open the admin centre.
Smart lockout threshold of 10 or fewer low Quick fix CIS 5.2.3.8 CE · User access control
Description
Checks that repeated wrong passwords lock an account quickly. Technically: the smart-lockout LockoutThreshold is 10 or fewer failed attempts.
Rationale
A high threshold gives password-spray and brute-force attacks more free guesses per account before anything slows them down.
Audit
Orbit reads LockoutThreshold from the Password Rule Settings values in GET /groupSettings, assuming Microsoft's default of 10 when unset. Pass at 10 or fewer; partial above.
Remediation
Microsoft Entra admin centre → Protection → Authentication methods → Password protection → Lockout threshold. Open the admin centre.
Lockout duration of 60 seconds or more low Quick fix CIS 5.2.3.9 CE · User access control
Description
Checks that a locked account stays locked long enough to blunt automated guessing. Technically: LockoutDurationInSeconds is at least 60.
Rationale
A short lockout barely interrupts an automated attack — the tooling simply waits it out and resumes at full speed.
Audit
Orbit reads LockoutDurationInSeconds from the Password Rule Settings values in GET /groupSettings, assuming the default of 60 when unset. Pass at 60 or more; partial below.
Remediation
Microsoft Entra admin centre → Protection → Authentication methods → Password protection → Lockout duration in seconds. Open the admin centre.
Passwordless methods enabled (Authenticator / FIDO2) high Moderate CE · User access control
Description
Checks that users can sign in without a password at all. Technically: the FIDO2 or Microsoft Authenticator method is enabled in the authentication methods policy.
Rationale
Passwords remain the credential attackers actually obtain; while passwordless methods are unavailable, every account keeps a phishable password as its anchor credential.
Audit
Orbit reads authenticationMethodConfigurations from GET /policies/authenticationMethodsPolicy and passes when Fido2 or MicrosoftAuthenticator is enabled; absent when neither.
Remediation
Microsoft Entra admin centre → Protection → Authentication methods → Policies → enable Passkey (FIDO2) and Microsoft Authenticator. Open the admin centre.
Authenticator registration campaign running medium Quick fix
Description
Checks that users still on weaker MFA methods are being nudged to Microsoft Authenticator. Technically: the registration campaign in the authentication methods policy is enabled.
Rationale
Users don't migrate off SMS by themselves; without the campaign, the tenant's phishable-method population shrinks only by staff turnover.
Audit
Orbit reads registrationEnforcement.authenticationMethodsRegistrationCampaign from GET /policies/authenticationMethodsPolicy. Pass when enabled; absent otherwise.
Remediation
Microsoft Entra admin centre → Protection → Authentication methods → Registration campaign → Enable. Open the admin centre.
Authentication Methods
Phishing-resistant method enabled (FIDO2 or certificate-based) high Moderate
Description
Checks that at least one unphishable sign-in method is available to users. Technically: the FIDO2 or X509Certificate method is enabled in the authentication methods policy.
Rationale
Push and code-based MFA can be phished or fatigued in real time; until a phishing-resistant method exists in the tenant, every MFA prompt is relayable.
Audit
Orbit reads the method states from GET /policies/authenticationMethodsPolicy. Pass when Fido2 or X509Certificate is enabled; partial otherwise (never absent — MFA exists, but relies on phishable methods).
Remediation
Microsoft Entra admin centre → Protection → Authentication methods → Policies → enable Passkey (FIDO2) or Certificate-based authentication. Open the admin centre.
SMS not used for authentication high Moderate CIS 5.2.3.5
Description
Checks that text-message sign-in codes are turned off. Technically: the Sms method in the authentication methods policy is not enabled.
Rationale
SMS codes are interceptable by SIM-swap and SS7-level attacks and phishable like any typed code — the weakest MFA method still in common use.
Audit
Orbit reads the Sms method state from GET /policies/authenticationMethodsPolicy. Pass when disabled; partial when enabled.
Remediation
Microsoft Entra admin centre → Protection → Authentication methods → Policies → Sms → disable, after migrating registered users. Open the admin centre.
Voice call not used for authentication medium Moderate CIS 5.2.3.5
Description
Checks that phone-call approval for sign-in is turned off. Technically: the Voice method in the authentication methods policy is not enabled.
Rationale
Voice approval shares SMS's interception weaknesses and trains users to approve calls they didn't initiate.
Audit
Orbit reads the Voice method state from GET /policies/authenticationMethodsPolicy. Pass when disabled; partial when enabled.
Remediation
Microsoft Entra admin centre → Protection → Authentication methods → Policies → Voice call → disable. Open the admin centre.
Email OTP not used for authentication medium Quick fix CIS 5.2.3.7
Description
Checks that emailed one-time codes aren't used for sign-in. Technically: the Email method in the authentication methods policy is not enabled.
Rationale
Email OTP protects an account with another account — often one with a weaker password and no MFA — making the mailbox the real perimeter.
Audit
Orbit reads the Email method state from GET /policies/authenticationMethodsPolicy. Pass when disabled; partial when enabled.
Remediation
Microsoft Entra admin centre → Protection → Authentication methods → Policies → Email OTP → disable. Open the admin centre.
System-preferred MFA enabled medium Quick fix CIS 5.2.3.6
Description
Checks that sign-ins automatically use the strongest MFA method each user has registered. Technically: systemCredentialPreferences in the authentication methods policy is enabled (or default).
Rationale
Without system-preferred MFA, a user registered for both Authenticator and SMS keeps being prompted by whichever they chose first — usually the weaker one.
Audit
Orbit reads systemCredentialPreferences.state from GET /policies/authenticationMethodsPolicy. Pass when enabled or default; partial when disabled.
Remediation
Microsoft Entra admin centre → Protection → Authentication methods → Settings → System-preferred multifactor authentication → Enable. Open the admin centre.
Authentication methods migration complete medium Moderate
Description
Checks that MFA settings are managed in one place rather than three. Technically: the authentication methods policy's policyMigrationState is migrationComplete.
Rationale
Until migration completes, the legacy per-user MFA and SSPR policies still apply in parallel — methods you disabled in the modern policy can remain live through the legacy ones.
Audit
Orbit reads policyMigrationState from GET /policies/authenticationMethodsPolicy. Pass when migrationComplete; partial otherwise.
Remediation
Microsoft Entra admin centre → Protection → Authentication methods → Policies → Manage migration → complete the guided migration. Open the admin centre.
Temporary Access Pass enabled low Quick fix
Description
Checks that admins can issue time-limited credentials for onboarding and recovery. Technically: the TemporaryAccessPass method is enabled in the authentication methods policy.
Rationale
Without TAP, bootstrapping a passwordless user or recovering a lost credential falls back to insecure workarounds — temporary passwords set by helpdesk and sent over chat.
Audit
Orbit reads the TemporaryAccessPass method state from GET /policies/authenticationMethodsPolicy. Pass when enabled; partial otherwise.
Remediation
Microsoft Entra admin centre → Protection → Authentication methods → Policies → Temporary Access Pass → Enable. Open the admin centre.
Users & Groups
Global Administrators kept to a minimum critical Moderate CIS 1.1.3 CE · User access control
Description
Checks that the number of all-powerful admin accounts is small but not one. Technically: between two and four users hold the Global Administrator role.
Rationale
Every Global Administrator is a full-tenant compromise waiting on one phished credential; below two, a single lost credential locks the organisation out of its own tenant.
Audit
Orbit reads Global Administrator membership via GET /directoryRoles and its members endpoint, counting user accounts only. Pass at 2–4; partial outside that range (too few or too many).
Remediation
Microsoft Entra admin centre → Identity → Roles & administrators → Global Administrator → move day-to-day admins to scoped roles (and Privileged Identity Management where licensed). Open the admin centre.
Privileged accounts are cloud-only high Project CIS 1.1.1
Description
Checks that admin accounts aren't synced in from on-premises Active Directory. Technically: no member of the ten highest-privilege directory roles has onPremisesSyncEnabled.
Rationale
A synced admin account means an on-premises AD compromise — the most common enterprise breach — escalates directly into Microsoft 365 admin control.
Audit
Orbit reads members of ten privileged roles (Global, Security, User, Application, Exchange, SharePoint admins and others) from GET /directoryRoles/{id}/members and flags any with onPremisesSyncEnabled. Pass when none; partial otherwise.
Remediation
Create cloud-only accounts for admin duties (Entra admin centre → Identity → Users), assign the roles to those, and remove roles from synced accounts. Open the admin centre.
Admin accounts have no mailbox medium Project CIS 1.1.4 CE · User access control
Description
Checks that admin accounts aren't also everyday mailbox accounts. Technically: no directory-role holder has an enabled Exchange assignedPlan.
Rationale
A mailbox makes an admin phishable at their most privileged identity: one convincing email to that address is a tenant-level incident, not a user-level one.
Audit
Orbit cross-references role holders from GET /directoryRoles members against user assignedPlans from GET /users, flagging admins with an enabled Exchange plan. Pass when none; partial otherwise.
Remediation
Separate duties: unlicensed admin accounts for administration, licensed everyday accounts for mail — then remove roles from the mailbox-holding accounts (Entra admin centre → Identity → Roles & administrators). Open the admin centre.
Administrators registered for MFA critical Quick fix CIS 5.2.2.1 CE · User access control
Description
Checks that every admin has actually set up MFA. Technically: no user flagged isAdmin in the MFA registration report has isMfaRegistered false.
Rationale
An MFA policy can only challenge methods that exist; an admin who never registered is protected by their password alone regardless of policy.
Audit
Orbit reads GET /reports/authenticationMethods/userRegistrationDetails and flags admins not registered for MFA. Any unregistered admin fails the check outright (no partial tier).
Remediation
Have each flagged admin register at aka.ms/mfasetup; enforce via the registration campaign and Conditional Access. Open the admin centre.
No dormant admin accounts (90+ days) high Quick fix CE · User access control
Description
Checks for admin accounts nobody has signed into for three months. Technically: no enabled directory-role holder's last sign-in is older than 90 days.
Rationale
A dormant admin account is standing privilege with no user watching it — the ideal account to quietly take over, since nobody notices activity on it.
Audit
Orbit cross-references role holders against signInActivity from GET /users (requires Entra ID P1) and flags enabled admins with no sign-in in 90 days — or none ever recorded. Pass when none; partial otherwise.
Remediation
Microsoft Entra admin centre → Identity → Roles & administrators → remove roles from (or disable) the dormant accounts. Open the admin centre.
Accounts with other admin roles low Moderate
Description
Surfaces accounts holding admin roles outside the ten highest-privilege ones, for review. Technically: users holding any other directory role (Directory Readers excepted).
Rationale
Mid-tier roles — Helpdesk, Intune, Teams admins — accumulate over time and are rarely reviewed; each is more blast radius on a phished account.
Audit
Orbit reads all role memberships from GET /directoryRoles and lists holders of non-privileged, non-benign roles. Any holder scores partial — this is a review prompt, not a fault.
Remediation
Microsoft Entra admin centre → Identity → Roles & administrators → review each listed assignment and remove those no longer needed. Open the admin centre.
All users registered for MFA critical Moderate CIS 5.2.3.4 CE · User access control
Description
Checks that every member account has MFA methods registered. Technically: no member in the MFA registration report has isMfaRegistered false.
Rationale
Unregistered users are the accounts password-spray finds first — and registration under duress (during an active compromise) hands the attacker the enrolment.
Audit
Orbit reads GET /reports/authenticationMethods/userRegistrationDetails and counts members not registered. Pass when none; partial while at least 80% are registered; absent beyond that.
Remediation
Run the Authenticator registration campaign (Entra admin centre → Protection → Authentication methods) and chase the remainder via the report's list. Open the admin centre.
Recent sign-ins used MFA high Moderate CE · User access control
Description
Checks that MFA is actually being exercised, not just configured. Technically: no recently signed-in user authenticated with only a single factor.
Rationale
Policy gaps show up here first: a user signing in without MFA is proof some scope, exclusion or legacy path lets them — whatever the policy intends.
Audit
Orbit samples the last 30 days of successful sign-ins (GET /auditLogs/signIns, most recent 1,000) and flags users whose sign-ins were single-factor. Pass when none; partial while at least 80% used MFA; absent beyond that. A sample, not a full audit — busy tenants exceed the window.
Remediation
Microsoft Entra admin centre → Identity → Monitoring & health → Sign-in logs → trace each flagged user's sign-in to find the policy gap that admitted it. Open the admin centre.
Recent sign-ins covered by Conditional Access high Moderate
Description
Checks that Conditional Access is actually evaluating sign- ins. Technically: no recently signed-in user's sign-ins show conditionalAccessStatus notApplied.
Rationale
A sign-in no policy applied to passed through the tenant's entire policy layer untouched — evidence of a coverage hole, not a healthy default.
Audit
Orbit samples the last 30 days of successful sign-ins (GET /auditLogs/signIns, most recent 1,000) and flags users whose sign-ins had no Conditional Access policy applied. Pass when none; partial while at least 80% were covered; absent beyond that. Same sampling caveat as the MFA sign-ins check.
Remediation
Microsoft Entra admin centre → Protection → Conditional Access → review policy scoping until baseline policies apply to all users and apps. Open the admin centre.
No inactive user accounts (90+ days) medium Moderate CE · User access control
Description
Checks for enabled accounts nobody has signed into for three months. Technically: no enabled member account's last sign-in is older than 90 days.
Rationale
Inactive enabled accounts are usually incomplete leaver processes: credentials that still work, often still licensed, with nobody watching for their misuse.
Audit
Orbit reads signInActivity per user from GET /users (requires Entra ID P1) and flags enabled members inactive for 90+ days or never signed in. Pass when none; partial while at least 80% are active; absent beyond that.
Remediation
Microsoft Entra admin centre → Identity → Users → disable and then remove the flagged accounts per your leaver process. Open the admin centre.
No empty security or Microsoft 365 groups low Quick fix
Description
Checks for groups with no members at all. Technically: no security or Microsoft 365 group has an empty member list.
Rationale
Empty groups linger in permission assignments and app grants; a later 'helpful' addition to one silently confers whatever access the group still carries.
Audit
Orbit reads GET /groups with members expanded and flags empty security and Microsoft 365 groups (distribution lists excluded). Pass when none; partial otherwise.
Remediation
Microsoft Entra admin centre → Identity → Groups → delete the empty groups after confirming nothing references them. Open the admin centre.
All groups have an owner low Quick fix
Description
Checks that every group has somebody accountable for it. Technically: no group's owners list is empty.
Rationale
Ownerless groups have nobody to answer access reviews or membership requests — governance actions on them dead-end at a directory object.
Audit
Orbit reads GET /groups with owners expanded and flags ownerless groups. Pass when none; partial otherwise.
Remediation
Microsoft Entra admin centre → Identity → Groups → assign owners to each flagged group. Open the admin centre.
Guests & External Identities
Guest invitations are restricted medium Quick fix CIS 5.1.6.3
Description
Checks who is allowed to invite external users into the directory. Technically: the authorization policy's allowInvitesFrom is none or adminsAndGuestInviters.
Rationale
When everyone — including existing guests — can invite, external accounts join the directory with no approval step anywhere; guest sprawl is the default outcome.
Audit
Orbit reads allowInvitesFrom from GET /policies/authorizationPolicy. Admins/guest-inviters only (or none) passes; members-too is partial; everyone is absent.
Remediation
Microsoft Entra admin centre → Identity → External Identities → External collaboration settings → Guest invite settings. Open the admin centre.
Guest directory access is restricted medium Quick fix CIS 5.1.6.2
Description
Checks how much of the directory external guests can read. Technically: the authorization policy's guestUserRoleId is the Restricted role.
Rationale
With member-equivalent access, any guest can enumerate your full user list and group structure — reconnaissance for phishing delivered free to any invited outsider.
Audit
Orbit reads guestUserRoleId from GET /policies/authorizationPolicy. Restricted passes; Microsoft's default Limited role is partial; member- equivalent access is absent.
Remediation
Microsoft Entra admin centre → Identity → External Identities → External collaboration settings → Guest user access → most restricted. Open the admin centre.
No guests hold directory roles critical Quick fix CE · User access control
Description
Checks that no external account holds admin rights in your directory. Technically: no guest user appears in any directory role's membership.
Rationale
An admin role on a guest account is privilege your organisation can neither credential-manage nor monitor — its security lives in someone else's tenant.
Audit
Orbit cross-references guest users (GET /users filtered to userType Guest) against role memberships from GET /directoryRoles. Any match fails the check outright.
Remediation
Microsoft Entra admin centre → Identity → Roles & administrators → remove the guest from the role; if the duty is real, use a member account instead. Open the admin centre.
No stale guest accounts (90+ days) medium Quick fix CIS 5.3.2 CE · User access control
Description
Checks for guest accounts that haven't been used in three months. Technically: no enabled, accepted guest's last sign-in is older than 90 days.
Rationale
Stale guests are finished collaborations whose access nobody revoked — every one is standing external access to whatever was shared with it.
Audit
Orbit reads guest users with signInActivity from GET /users (requires Entra ID P1 for sign-in data) and flags enabled guests inactive for 90+ days. Pass when none; partial while at least 80% of guests are current; absent beyond that.
Remediation
Microsoft Entra admin centre → Identity → Users → filter to guests → delete stale accounts (access reviews automate this where licensed). Open the admin centre.
No pending guest invitations low Quick fix
Description
Checks for guest invitations that were sent but never accepted. Technically: no guest account sits in the PendingAcceptance state.
Rationale
A pending invitation is a live credential offer sitting in an external mailbox indefinitely — redeemable long after the reason for it has passed.
Audit
Orbit reads externalUserState per guest from GET /users and flags PendingAcceptance accounts. Pass when none; partial while they're under 20% of guests; absent beyond that.
Remediation
Microsoft Entra admin centre → Identity → Users → delete unredeemed invitations and re-invite only where still needed. Open the admin centre.
App Management
User consent for apps restricted critical Quick fix CIS 5.1.5.1
Description
Checks that users can't grant third-party apps access to company data by themselves. Technically: the default user role's permission- grant policies are empty (admin approval required) or limited to low-risk verified publishers.
Rationale
Open user consent is the consent-phishing vector: one convincing OAuth prompt and an attacker's app holds a durable, MFA-proof token to the user's mail and files.
Audit
Orbit reads defaultUserRolePermissions.permissionGrantPoliciesAssigned from GET /policies/authorizationPolicy. No grant policies, or a low-risk-only policy, passes; anything broader is absent.
Remediation
Microsoft Entra admin centre → Identity → Applications → Enterprise applications → Consent and permissions → User consent settings. Open the admin centre.
User consent blocked for risky apps high Quick fix
Description
Checks that consent requests Microsoft classes as risky are blocked outright. Technically: the BlockUserConsentForRiskyApps consent setting is true.
Rationale
Risk-classified consent requests are the ones Microsoft's own telemetry associates with consent-phishing campaigns; allowing them relies on each user's judgement at the prompt.
Audit
Orbit reads BlockUserConsentForRiskyApps from the Consent Policy Settings values in GET /groupSettings. Pass when true; partial otherwise.
Remediation
Enabled by default via the Consent Policy Settings directory setting; re-enable via Graph PowerShell if it has been turned off. Open the admin centre.
Group owner consent disabled medium Quick fix
Description
Checks that group owners can't grant apps access to their group's data. Technically: the EnableGroupSpecificConsent consent setting is false.
Rationale
Group-owner consent is user consent with a wider blast radius: one owner's approval exposes the whole group's files and conversations to the app.
Audit
Orbit reads EnableGroupSpecificConsent from the Consent Policy Settings values in GET /groupSettings. Pass when false; partial otherwise.
Remediation
Microsoft Entra admin centre → Identity → Applications → Enterprise applications → Consent and permissions → Group owner consent settings. Open the admin centre.
Admin consent request workflow enabled medium Quick fix CIS 5.1.5.2
Description
Checks that users have a governed route to request app approvals. Technically: the admin consent request policy's isEnabled is true.
Rationale
With consent restricted and no request workflow, users work around IT — unmanaged personal accounts and shadow tools — instead of surfacing the request for review.
Audit
Orbit reads GET /policies/adminConsentRequestPolicy and passes when the workflow is enabled; absent otherwise.
Remediation
Microsoft Entra admin centre → Identity → Applications → Enterprise applications → Admin consent settings → enable requests and set reviewers. Open the admin centre.
App registration restricted to admins medium Quick fix CIS 5.1.2.2
Description
Checks that ordinary users can't create app registrations. Technically: the default user role's allowedToCreateApps is false.
Rationale
A user-created app registration is an unmonitored credential store: its owner can mint secrets and request permissions outside any admin's view.
Audit
Orbit reads defaultUserRolePermissions.allowedToCreateApps from GET /policies/authorizationPolicy. Pass when false; partial otherwise.
Remediation
Microsoft Entra admin centre → Identity → Users → User settings → “Users can register applications” → No. Open the admin centre.
No expired application credentials low Moderate
Description
Checks for app registrations carrying expired secrets or certificates. Technically: no application credential's endDateTime is in the past.
Rationale
Expired credentials mean either a broken integration nobody noticed or an abandoned app nobody owns — both signs the app estate isn't being managed.
Audit
Orbit reads passwordCredentials and keyCredentials per app from GET /applications and flags any expired. Any expired credential fails the check outright.
Remediation
Microsoft Entra admin centre → Identity → Applications → App registrations → rotate or remove the expired credentials; delete abandoned apps. Open the admin centre.
No credentials expiring within 30 days low Moderate
Description
Checks for app secrets and certificates about to expire. Technically: no application credential's endDateTime falls within the next 30 days.
Rationale
An expiring credential is a scheduled outage for whatever integration uses it — and expiry-day scrambles produce rushed, long-lived replacement secrets.
Audit
Orbit reads credential expiry dates per app from GET /applications and flags any ending within 30 days. Pass when none; partial otherwise.
Remediation
Microsoft Entra admin centre → Identity → Applications → App registrations → Certificates & secrets → rotate ahead of expiry. Open the admin centre.
No secrets valid longer than 2 years medium Moderate CIS 5.1.5.4
Description
Checks that app secrets aren't issued with excessive lifetimes. Technically: no application credential spans more than 730 days from start to end.
Rationale
A long-lived secret that leaks stays usable for years; short lifetimes bound the exposure window of any leak to months.
Audit
Orbit computes each credential's validity span from GET /applications and flags any over two years. Pass when none; partial otherwise.
Remediation
Microsoft Entra admin centre → Identity → Applications → App registrations → replace long-lived secrets with shorter ones (or certificates) at next rotation. Open the admin centre.
All app registrations have an owner low Moderate
Description
Checks that every app registration has somebody accountable for it. Technically: no application's owners list is empty.
Rationale
Ownerless apps are unrotatable in practice — nobody knows what breaks if a secret is revoked, so nobody ever revokes it.
Audit
Orbit reads GET /applications with owners expanded and flags ownerless registrations. Pass when none; partial otherwise.
Remediation
Microsoft Entra admin centre → Identity → Applications → App registrations → Owners → assign at least one per app. Open the admin centre.
No apps with high-impact access to tenant data high Moderate
Description
Surfaces apps holding tenant-wide access to mail, files or the directory, for review. Technically: app-role grants in a two-dozen-strong high-privilege set (Directory.ReadWrite.All, Mail.Read, Sites.FullControl.All and similar), plus tenant-wide delegated grants of comparable scope.
Rationale
Each such grant is a standing, MFA-proof path to organisation- wide data through the app's own credentials — app compromise equals tenant data breach.
Audit
Orbit reads app-role assignments on the Microsoft Graph, Exchange and SharePoint service principals (GET /servicePrincipals/{id}/appRoleAssignedTo) and tenant-wide entries from GET /oauth2PermissionGrants, matching against its high-privilege permission set. Any holder scores partial — a review prompt, since some grants are legitimate.
Remediation
Microsoft Entra admin centre → Identity → Applications → Enterprise applications → Permissions → review each listed app and revoke grants that aren't justified. Open the admin centre.
No dormant enterprise apps medium Moderate
Description
Checks for third-party apps still holding access nobody has used in three months. Technically: no enabled non-Microsoft service principal's last sign-in is older than 90 days.
Rationale
A dormant app's permissions and credentials remain live; it's the app-world equivalent of a leaver's account — access without a user.
Audit
Orbit joins enabled third-party service principals (GET /servicePrincipals) with GET /servicePrincipalSignInActivities (beta; requires Entra ID P1) and flags apps with no sign-in in 90 days or none recorded. Pass when none; partial otherwise. Skipped when sign-in activity is unavailable.
Remediation
Microsoft Entra admin centre → Identity → Applications → Enterprise applications → delete or disable the dormant apps. Open the admin centre.
Third-party apps have verified publishers medium Moderate
Description
Checks that external apps in the tenant come from publishers Microsoft has verified. Technically: no enabled third-party service principal lacks a verifiedPublisher.
Rationale
Unverified publishers are the norm in consent-phishing tooling; verification ties an app to a vetted Microsoft partner identity that can be held to account.
Audit
Orbit reads verifiedPublisher on enabled, external, application- type service principals from GET /servicePrincipals (Microsoft's own and your tenant's apps excluded). Pass when all are verified; partial otherwise.
Remediation
Microsoft Entra admin centre → Identity → Applications → Enterprise applications → review each unverified app; replace or remove those without a credible publisher. Open the admin centre.
Intune
Device Management
Device compliance policies configured high Moderate CIS 4.1 CE · Secure configuration
Description
Checks that rules exist defining what a healthy, trustworthy device looks like. Technically: at least one Intune device compliance policy exists in the tenant.
Rationale
Without compliance policies every enrolled device is implicitly trusted — an out-of-date, unencrypted or unhealthy device gets the same access as a hardened one, and Conditional Access can't require compliant devices because nothing defines compliance.
Audit
Orbit reads GET /deviceManagement/deviceCompliancePolicies and passes if at least one policy exists. Presence only — assignment and per- setting strictness aren't evaluated.
Remediation
Intune admin centre → Devices → Compliance → Create policy, then assign it to all device groups. Open the admin centre.
All devices compliant with compliance policies high Moderate CE · Secure configuration
Description
Checks that managed devices actually meet the compliance rules set for them. Technically: no managed device reports a complianceState of noncompliant, error, conflict or in-grace-period.
Rationale
A non-compliant device has already failed the tenant's own definition of trustworthy — commonly missing encryption, an outdated OS or a lapsed check-in — yet may still hold cached corporate data and active sessions.
Audit
Orbit reads complianceState per device from GET /deviceManagement/managedDevices. Pass when no device is in a failing state; partial while failing devices are a minority (up to half); absent beyond that. Devices in grace period count as failing.
Remediation
Intune admin centre → Devices → Compliance → Monitor → Noncompliant devices; fix per-device causes or adjust the policy if a rule is wrong. Open the admin centre.
Configuration profiles deploying without errors medium Moderate
Description
Checks that the settings Intune pushes to devices are arriving cleanly. Technically: the tenant-wide device configuration state summary reports zero devices in error or conflict.
Rationale
A profile in error or conflict means the intended configuration — often a security setting — is not applied on those devices, while the console still shows the profile as deployed.
Audit
Orbit reads errorDeviceCount and conflictDeviceCount from GET /deviceManagement/deviceConfigurationDeviceStateSummaries. Pass when both are zero; otherwise partial. This is a tenant aggregate — Orbit doesn't identify which profile is failing.
Remediation
Intune admin centre → Devices → Configuration → open each profile's Device status to find the failing devices, and resolve conflicts by removing duplicate settings across profiles. Open the admin centre.
All devices syncing with Intune medium Moderate
Description
Checks that managed devices are still checking in. Technically: every managed device has a lastSyncDateTime within the last 30 days.
Rationale
A device that stops syncing stops receiving policy, compliance evaluation and remote actions — wipe and lock included — while still holding corporate data and credentials.
Audit
Orbit reads lastSyncDateTime per device from GET /deviceManagement/managedDevices and flags devices with no sync in over 30 days (or none recorded). Pass when none are stale; partial while stale devices are a minority; absent beyond half.
Remediation
Intune admin centre → Devices → All devices → filter by last check-in; retire or wipe devices that are genuinely gone, and troubleshoot the rest. Open the admin centre.
All devices encrypted critical Moderate
Description
Checks that company devices scramble their storage so a lost or stolen device doesn't give up its data. Technically: no managed device reports isEncrypted as false.
Rationale
An unencrypted device that is lost or stolen exposes every file, cached mailbox and saved credential on it to anyone who removes the disk — no password required.
Audit
Orbit reads isEncrypted per device from GET /deviceManagement/managedDevices and flags devices explicitly reporting false. Pass when none do; partial while they're a minority; absent beyond half. Devices that don't report the property at all aren't flagged.
Remediation
Intune admin centre → Devices → All devices to find the unencrypted devices; enforce BitLocker/FileVault via Endpoint security → Disk encryption. Open the admin centre.
No jailbroken or rooted devices critical Quick fix CE · Secure configuration
Description
Checks that no phone or tablet with broken security controls can reach company data. Technically: no managed device reports jailBroken as true.
Rationale
A jailbroken or rooted device has its platform protections disabled: malware can read app data, keychains and tokens, and every app-level control Intune applies can be bypassed.
Audit
Orbit reads the jailBroken property per device from GET /deviceManagement/managedDevices. A single affected device fails the check outright (absent, no partial tier).
Remediation
Intune admin centre → Devices → All devices → retire the affected device and block it via compliance policy (Device health → Jailbroken devices → Block). Open the admin centre.
No devices with pending actions low Quick fix
Description
Checks that remote commands sent to devices have actually completed. Technically: no managed device has an entry in deviceActionResults still in the pending or active state.
Rationale
A stuck remote wipe or retire means an action you believe has protected a lost device hasn't happened — the data is still on it.
Audit
Orbit reads deviceActionResults per device from GET /deviceManagement/managedDevices and flags any action still pending or active. Pass when none are; otherwise partial. A freshly issued action looks the same as a stuck one, so expect transient flags just after issuing commands.
Remediation
Intune admin centre → Devices → All devices → open the device → Device actions status; reissue actions that have stalled. Open the admin centre.
Mobile App Protection
iOS app protection policy configured high Moderate
Description
Checks that company data inside apps on iPhones and iPads is protected even on personal devices. Technically: at least one iOS app protection (MAM) policy exists.
Rationale
Without an app protection policy, corporate data in Outlook, Teams and Office on an unmanaged iOS device can be copied, backed up or moved into personal apps without restriction — and can't be selectively wiped when someone leaves.
Audit
Orbit reads GET /deviceAppManagement/iosManagedAppProtections and passes if at least one policy exists.
Remediation
Intune admin centre → Apps → App protection policies → Create policy → iOS/iPadOS, targeting the core Microsoft 365 apps. Open the admin centre.
Android app protection policy configured high Moderate
Description
Checks that company data inside apps on Android phones is protected even on personal devices. Technically: at least one Android app protection (MAM) policy exists.
Rationale
Without an app protection policy, corporate data in mobile apps on unmanaged Android devices can flow freely into personal apps and cloud backups, and can't be selectively wiped.
Audit
Orbit reads GET /deviceAppManagement/androidManagedAppProtections and passes if at least one policy exists.
Remediation
Intune admin centre → Apps → App protection policies → Create policy → Android, targeting the core Microsoft 365 apps. Open the admin centre.
App access PIN required medium Quick fix
Description
Checks that opening a work app on a mobile requires a PIN. Technically: every app protection policy sets pinRequired to true.
Rationale
Without an app PIN, anyone holding an unlocked phone — borrowed, lost or stolen — can open corporate mail and files directly; the app PIN is the only barrier on devices with weak or shared unlock codes.
Audit
Orbit reads pinRequired on every iOS and Android app protection policy. Pass only when all policies require a PIN; otherwise partial, listing the policies that don't.
Remediation
Intune admin centre → Apps → App protection policies → edit each policy → Access requirements → PIN for access: Require. Open the admin centre.
Data transfer limited to managed apps high Quick fix
Description
Checks that work data can't be sent from work apps into personal apps on mobiles. Technically: every app protection policy restricts allowedOutboundDataTransferDestinations to managedApps.
Rationale
If outbound transfer is open, a user can share a corporate document from Outlook into any personal app — WhatsApp, Gmail, a notes app — taking the data outside every control the tenant has.
Audit
Orbit reads allowedOutboundDataTransferDestinations on every app protection policy. Pass only when all policies restrict transfer to managed apps; otherwise partial.
Remediation
Intune admin centre → Apps → App protection policies → edit each policy → Data protection → Send org data to other apps: Policy managed apps. Open the admin centre.
App data backup blocked medium Quick fix
Description
Checks that work data isn't silently copied into personal cloud backups of a phone. Technically: every app protection policy sets disableAppBackup to true.
Rationale
iCloud and Android backups of app data place corporate content in a personal consumer cloud account, outside retention, wipe and legal-hold controls — and it stays there after the employee leaves.
Audit
Orbit reads disableAppBackup on every app protection policy. Pass only when all policies block backup; otherwise partial.
Remediation
Intune admin centre → Apps → App protection policies → edit each policy → Data protection → Back up org data: Block. Open the admin centre.
App data encrypted high Quick fix
Description
Checks that work data stored inside mobile apps is encrypted by the app itself. Technically: every app protection policy sets encryptAppData to true.
Rationale
Without app-level encryption, corporate data cached by mobile apps relies solely on device encryption — absent or bypassable on unmanaged personal devices.
Audit
Orbit reads encryptAppData on every app protection policy. Pass only when all policies encrypt; otherwise partial.
Remediation
Intune admin centre → Apps → App protection policies → edit each policy → Data protection → Encrypt org data: Require. Open the admin centre.
Security Baselines
Windows 10 and later baseline deployed high Moderate CE · Secure configuration
Description
Checks that Windows devices get Microsoft's recommended security settings as a bundle. Technically: an Intune security-baseline profile for Windows 10 and later exists and is assigned.
Rationale
Without the baseline, hundreds of hardening settings — SmartScreen, credential protection, script and macro controls — are left at permissive defaults unless someone has configured each one by hand.
Audit
Orbit reads Intune's template and intent lists (GET /deviceManagement/templates and /deviceManagement/intents, beta) and looks for a deployed profile whose baseline template name contains “Windows 10”. Absent when none exists; partial when deployed but assigned to no group; pass when assigned. Matching is by template name, so renamed templates can misreport.
Remediation
Intune admin centre → Endpoint security → Security baselines → Windows 10 and later → Create profile, and assign it. Open the admin centre.
Microsoft 365 Apps baseline deployed medium Moderate CE · Secure configuration
Description
Checks that Office apps on Windows get Microsoft's recommended hardening. Technically: the Microsoft 365 Apps for Enterprise security baseline is deployed and assigned.
Rationale
Office macros and add-ins are a primary malware entry route; without the baseline, macro blocking and Protected View settings depend on per-machine defaults.
Audit
Same template/intent read as the Windows baseline, matching profiles whose template name contains “365 Apps”. Absent / partial (unassigned) / pass (assigned).
Remediation
Intune admin centre → Endpoint security → Security baselines → Microsoft 365 Apps for Enterprise → Create profile, and assign it. Open the admin centre.
Microsoft Edge baseline deployed medium Moderate CE · Secure configuration
Description
Checks that the Edge browser gets Microsoft's recommended security settings. Technically: the Microsoft Edge security baseline is deployed and assigned.
Rationale
The browser is where credential phishing and drive-by downloads happen; without the baseline, SmartScreen and site-isolation protections vary per machine.
Audit
Same template/intent read, matching template names containing “Edge”. Absent / partial (unassigned) / pass (assigned).
Remediation
Intune admin centre → Endpoint security → Security baselines → Microsoft Edge → Create profile, and assign it. Open the admin centre.
Microsoft Defender for Endpoint baseline deployed high Moderate CE · Secure configuration
Description
Checks that Microsoft's recommended settings for its endpoint detection product are applied. Technically: the Defender for Endpoint security baseline is deployed and assigned.
Rationale
Defender for Endpoint with weakened settings — reduced cloud protection, disabled tamper protection — detects less and can be switched off by the attacker it's meant to catch.
Audit
Same template/intent read, matching template names containing “Defender for Endpoint”. Absent / partial (unassigned) / pass (assigned). Requires Defender for Endpoint licensing to be meaningful.
Remediation
Intune admin centre → Endpoint security → Security baselines → Microsoft Defender for Endpoint → Create profile, and assign it. Open the admin centre.
Windows 365 baseline deployed low Moderate CE · Secure configuration
Description
Checks that Cloud PCs get Microsoft's recommended security settings. Technically: the Windows 365 security baseline is deployed and assigned.
Rationale
Cloud PCs are full Windows desktops reachable from anywhere; left at defaults they carry the same hardening gaps as an unmanaged laptop.
Audit
Same template/intent read, matching template names containing “Windows 365”. Absent / partial (unassigned) / pass (assigned). Only relevant to tenants using Windows 365.
Remediation
Intune admin centre → Endpoint security → Security baselines → Windows 365 → Create profile, and assign it. Open the admin centre.
Endpoint Security
Antivirus policy configured critical Moderate CE · Malware protection
Description
Checks that devices have centrally managed antivirus protection. Technically: at least one Intune endpoint-security policy in the Antivirus category exists.
Rationale
Unmanaged antivirus means no guarantee real-time protection is on, exclusions are sane or tamper protection is enforced — users or malware can simply turn it off.
Audit
Orbit reads Intune's endpoint-security intents (GET /deviceManagement/intents with /deviceManagement/templates, beta) and passes if any deployed policy's template name matches the Antivirus category. Presence only — assignment isn't checked.
Remediation
Intune admin centre → Endpoint security → Antivirus → Create policy. Open the admin centre.
Disk encryption policy configured critical Moderate
Description
Checks that device disk encryption is enforced centrally rather than left to chance. Technically: at least one endpoint-security Disk encryption (BitLocker/FileVault) policy exists.
Rationale
Without an enforcement policy, encryption depends on per-device defaults; one unencrypted lost laptop is a reportable data breach.
Audit
Same endpoint-security intent read, matching the Disk encryption category (BitLocker/FileVault template names). Pass if any policy exists; absent otherwise.
Remediation
Intune admin centre → Endpoint security → Disk encryption → Create policy. Open the admin centre.
Firewall policy configured high Moderate CE · Firewalls
Description
Checks that the built-in firewall on devices is managed and can't be quietly disabled. Technically: at least one endpoint-security Firewall policy exists.
Rationale
With no firewall policy, a user or installer can disable the host firewall and nothing turns it back on — leaving the device open on hostile networks.
Audit
Same endpoint-security intent read, matching the Firewall category. Pass if any policy exists; absent otherwise.
Remediation
Intune admin centre → Endpoint security → Firewall → Create policy. Open the admin centre.
Endpoint detection & response policy configured critical Moderate
Description
Checks that devices are enrolled into endpoint detection and response tooling. Technically: at least one endpoint-security EDR policy exists.
Rationale
Without EDR onboarding, a compromised device generates no alert and no forensic timeline — intrusions are discovered by their consequences instead.
Audit
Same endpoint-security intent read, matching the EDR category. Pass if any policy exists; absent otherwise. Needs Defender for Endpoint licensing to onboard devices.
Remediation
Intune admin centre → Endpoint security → Endpoint detection and response → Create policy. Open the admin centre.
Attack surface reduction policy configured high Moderate
Description
Checks that common malware entry routes on Windows are blocked by policy. Technically: at least one endpoint-security Attack surface reduction policy exists.
Rationale
ASR rules block the standard initial-access tricks — Office spawning child processes, script-borne downloads, credential theft from LSASS. Without them those doors are open on every device.
Audit
Same endpoint-security intent read, matching the ASR category. Pass if any policy exists; absent otherwise.
Remediation
Intune admin centre → Endpoint security → Attack surface reduction → Create policy. Open the admin centre.
Account protection (LAPS / Hello) policy configured high Moderate CIS 5.1.4.5 CE · Secure configuration
Description
Checks that local accounts on devices are protected by policy — rotating local admin passwords or Windows Hello requirements. Technically: at least one endpoint-security Account protection policy exists.
Rationale
Identical or unmanaged local administrator passwords let an attacker who compromises one machine move laterally to all of them with the same credential.
Audit
Same endpoint-security intent read, matching the Account protection category (LAPS / Windows Hello template names). Pass if any policy exists; absent otherwise.
Remediation
Intune admin centre → Endpoint security → Account protection → Create policy (Local admin password solution for LAPS). Open the admin centre.
Update Management
Windows Update ring configured high Moderate CE · Security update management
Description
Checks that Windows security updates are rolled out under central control. Technically: at least one Windows Update for Business update ring exists.
Rationale
Without update rings, patching depends on each device's own Windows Update behaviour — deferred, metered or paused devices quietly fall months behind on security fixes.
Audit
Orbit reads GET /deviceManagement/deviceConfigurations and passes if any configuration is a Windows Update for Business ring (identified by its @odata.type).
Remediation
Intune admin centre → Devices → Windows updates → Update rings → Create profile. Open the admin centre.
Updates install automatically high Quick fix CE · Security update management
Description
Checks that update rings actually install updates rather than leaving it to users. Technically: no update ring has automaticUpdateMode set to user-defined or not-configured.
Rationale
A ring that leaves installation to the user is a ring in name only — the machines it covers patch whenever their users feel like rebooting, which for some is never.
Audit
Orbit reads automaticUpdateMode on each update ring from GET /deviceManagement/deviceConfigurations. Pass when every ring installs automatically; otherwise partial. Only evaluated when at least one ring exists.
Remediation
Intune admin centre → Devices → Windows updates → Update rings → edit each ring → Automatic update behaviour: Auto install (and restart) at maintenance time. Open the admin centre.
Feature update profile configured medium Moderate CE · Security update management
Description
Checks that the Windows version devices run is pinned deliberately. Technically: at least one Windows feature update profile exists.
Rationale
Without a feature update profile, devices jump Windows versions on Microsoft's schedule — or stall on a release approaching end of servicing, after which they stop receiving security updates.
Audit
Orbit reads GET /deviceManagement/windowsFeatureUpdateProfiles (beta). Pass if any profile exists; partial otherwise.
Remediation
Intune admin centre → Devices → Windows updates → Feature updates → Create profile. Open the admin centre.
Device Enrollment
Enrollment platform restrictions configured medium Quick fix CIS 4.2
Description
Checks that there are rules about which device types may enrol into management. Technically: at least one device enrollment platform restriction exists.
Rationale
With no platform restrictions, any user can enrol any device — including personally owned or obsolete platforms — and acquire the access that managed devices are granted.
Audit
Orbit reads GET /deviceManagement/deviceEnrollmentConfigurations and passes if a platform-restriction configuration exists.
Remediation
Intune admin centre → Devices → Enrollment → Enrollment device platform restrictions. Open the admin centre.
Per-user device enrollment limit set low Quick fix CIS 5.1.4.2
Description
Checks that one account can't enrol an unlimited number of devices. Technically: a device enrollment limit configuration exists.
Rationale
An unlimited enrolment allowance lets one compromised account register attacker-controlled devices at will, each one inheriting the trust given to managed devices.
Audit
Same enrollment-configuration read, looking for a device-limit configuration. Pass if one exists; partial otherwise.
Remediation
Intune admin centre → Devices → Enrollment → Enrollment device limit restrictions. Open the admin centre.
Windows Hello for Business configured medium Moderate CE · User access control
Description
Checks that sign-in to Windows devices can use strong, device-bound credentials instead of passwords. Technically: a Windows Hello for Business enrollment configuration exists.
Rationale
Password-only Windows sign-in keeps a phishable, reusable credential in daily use; Hello's PIN and biometrics are bound to the device and never leave it.
Audit
Same enrollment-configuration read, looking for a Windows Hello configuration. Pass if one exists; partial otherwise. Presence only — Orbit doesn't check whether Hello is set to Enabled inside it.
Remediation
Intune admin centre → Devices → Enrollment → Windows Hello for Business. Open the admin centre.
Teams
Governance
Every Team has an owner medium Quick fix
Description
Checks that every Team has somebody responsible for it. Technically: no Team's owners list is empty.
Rationale
An ownerless Team has nobody to approve membership, review guests or delete stale content — requests and access reviews dead-end, and sprawl accumulates unaccountably.
Audit
Orbit lists Teams-provisioned groups via GET /groups filtered on resourceProvisioningOptions, expanding owners, and flags Teams with none. Pass when none are ownerless; absent otherwise.
Remediation
Teams admin centre → Teams → Manage teams → assign an owner to each flagged Team. Open the admin centre.
Teams have at least two owners low Quick fix
Description
Checks that no Team depends on a single person. Technically: no Team has exactly one owner.
Rationale
A single-owner Team becomes ownerless the day that person leaves — and until noticed, nobody can manage its membership or guests.
Audit
Same Teams read; flags Teams with exactly one owner. Pass when none; partial otherwise.
Remediation
Teams admin centre → Teams → Manage teams → add a second owner to each flagged Team. Open the admin centre.
Every Team has an active owner medium Quick fix
Description
Checks that Team owners are real, working accounts. Technically: every Team with owners has at least one whose account is enabled.
Rationale
A Team owned only by disabled accounts — typically leavers — is ownerless in practice: nobody can approve or remove members despite the directory saying otherwise.
Audit
Same Teams read, checking accountEnabled on each owner. Pass when every owned Team has an enabled owner; absent otherwise.
Remediation
Teams admin centre → Teams → Manage teams → replace disabled owners on the flagged Teams. Open the admin centre.
No guest Team owners high Quick fix
Description
Checks that people outside the organisation don't control Teams. Technically: no Team owner has userType guest.
Rationale
A guest owner — an external account your organisation doesn't control — can add members, invite further guests and change settings on a Team full of your data.
Audit
Same Teams read, checking userType on each owner. Pass when no owner is a guest; absent otherwise.
Remediation
Teams admin centre → Teams → Manage teams → remove guest owners; prevent recurrence via Entra's external collaboration settings. Open the admin centre.
No empty Teams low Quick fix
Description
Checks for Teams with no members at all. Technically: no Team's member list is empty.
Rationale
Empty Teams are clutter with attack surface: their SharePoint sites, mailboxes and sharing settings persist, unwatched by any member.
Audit
Same Teams read with members expanded; flags Teams with no members. Pass when none; partial otherwise.
Remediation
Teams admin centre → Teams → Manage teams → archive or delete the empty Teams. Open the admin centre.
No public Teams medium Moderate CIS 1.2.1
Description
Checks that Teams aren't open for anyone in the organisation to join unseen. Technically: no Team has visibility set to public.
Rationale
Any user — including a compromised account — can join a public Team and read its entire file library and message history without anyone approving or noticing.
Audit
Orbit reads visibility per Team from the Teams group list. Pass when none are public; partial otherwise.
Remediation
Teams admin centre → Teams → Manage teams → set flagged Teams to Private (review whether each is deliberate first). Open the admin centre.
Teams with guests reviewed medium Moderate
Description
Checks which Teams currently contain external guests, for regular review. Technically: Teams whose guest count in the Teams activity report is above zero.
Rationale
Guest access outlives projects: an external partner keeps reading a Team's files until someone removes them, and without review nobody does.
Audit
Orbit reads guest counts from GET /reports/getTeamsTeamActivityDetail(period='D90') (falling back to sampled membership when the report is unavailable) and lists Teams with guests. Pass when none have guests; partial otherwise — this is a review prompt, not a fault.
Remediation
Teams admin centre → Teams → Manage teams → review the guest list of each flagged Team and remove finished collaborations. Open the admin centre.
No dormant Teams low Moderate
Description
Checks for Teams nobody has used in three months. Technically: no Team's last activity date in the activity report is older than 90 days.
Rationale
Dormant Teams keep their files shared and their guests attached long after the work ended — data exposure with no active members to notice it.
Audit
Orbit reads last-activity dates from GET /reports/getTeamsTeamActivityDetail(period='D90') and flags Teams inactive for over 90 days or missing from the report. Pass when none; partial otherwise. Only evaluated when the usage report is available.
Remediation
Teams admin centre → Teams → Manage teams → archive or delete dormant Teams (an expiration policy automates this — see the Policies report). Open the admin centre.
Policies
Team / group creation restricted medium Moderate CIS 5.1.3.4
Description
Checks that not every user can create Teams and Microsoft 365 Groups at will. Technically: the Group.Unified directory setting has EnableGroupCreation set to false.
Rationale
Unrestricted creation produces sprawl nobody governs — hundreds of ownerless, duplicate or abandoned Teams, each with its own shareable site.
Audit
Orbit reads the Group.Unified template values from GET /groupSettings and checks EnableGroupCreation is “false”. The setting only exists once customised — a tenant on Microsoft defaults scores partial (creation open to all).
Remediation
Set via Graph PowerShell: update the Group.Unified directory setting (EnableGroupCreation=false, GroupCreationAllowedGroupId=<group>). No portal toggle exists. Open the admin centre.
Group naming policy configured low Quick fix
Description
Checks that new groups follow a naming convention. Technically: Group.Unified's PrefixSuffixNamingRequirement is non-empty.
Rationale
Without a naming policy, look-alike and joke names accumulate; users can create groups impersonating official ones, and admins can't tell sanctioned workspaces from abandoned experiments.
Audit
Orbit reads PrefixSuffixNamingRequirement from the Group.Unified values in GET /groupSettings. Pass when set; partial otherwise (including tenants on defaults).
Remediation
Microsoft Entra admin centre → Identity → Groups → Group settings → Naming policy. Open the admin centre.
Group classification or sensitivity labels enabled medium Moderate
Description
Checks that Teams and groups can be marked by confidentiality. Technically: Group.Unified has EnableMIPLabels true or a non- empty ClassificationList.
Rationale
Unlabelled workspaces give members no signal about what may be stored or shared there — a Confidential project team and a social club look identical.
Audit
Orbit reads EnableMIPLabels and ClassificationList from GET /groupSettings. Pass when either is configured; partial otherwise.
Remediation
Enable sensitivity labels for groups (Purview portal → Information protection) or set a classification list via the Group.Unified directory setting. Open the admin centre.
Group expiration policy configured medium Quick fix
Description
Checks that unused Teams and groups expire automatically. Technically: at least one group lifecycle policy exists.
Rationale
Without expiry, every Team ever created persists forever with its files and guests — dormant-workspace cleanup relies entirely on humans remembering.
Audit
Orbit reads GET /groupLifecyclePolicies and passes if any policy exists; partial otherwise.
Remediation
Microsoft Entra admin centre → Identity → Groups → Group settings → Expiration. Open the admin centre.
Guest access to groups controlled high Quick fix
Description
Checks that adding external guests to Teams and groups is a deliberate decision, not a default. Technically: Group.Unified.Guest has AllowToAddGuests set to false.
Rationale
When any member can add any guest, external access to internal files is granted ad hoc with no approval step and no record of why.
Audit
Orbit reads AllowToAddGuests from the Group.Unified.Guest template in GET /groupSettings. Pass when false; partial otherwise (Microsoft's default allows guests).
Remediation
Set the Group.Unified.Guest directory setting (AllowToAddGuests=false) via Graph PowerShell, or control per-group in the Entra admin centre. Open the admin centre.
Guests can't own Teams / groups high Quick fix
Description
Checks that external guests can't be made owners of Teams or groups. Technically: Group.Unified has AllowGuestsToBeGroupOwner set to false.
Rationale
A guest owner controls membership and settings of a workspace your organisation doesn't control the account for — including inviting further external accounts.
Audit
Orbit reads AllowGuestsToBeGroupOwner from GET /groupSettings. Pass when false; partial otherwise (default permits it).
Remediation
Set AllowGuestsToBeGroupOwner=false in the Group.Unified directory setting via Graph PowerShell. Open the admin centre.
Guest invitations restricted medium Quick fix CIS 5.1.6.3
Description
Checks that not everyone — including guests themselves — can invite new external users. Technically: the authorization policy's allowInvitesFrom is none or adminsAndGuestInviters.
Rationale
With open invitations, any member or existing guest can bring arbitrary external accounts into the directory — guest sprawl with no approval anywhere.
Audit
Orbit reads allowInvitesFrom from GET /policies/authorizationPolicy. Pass when restricted to admins and guest inviters (or off); partial otherwise.
Remediation
Microsoft Entra admin centre → Identity → External Identities → External collaboration settings → Guest invite settings. Open the admin centre.
SharePoint
External Sharing
External sharing restricted critical Moderate CIS 7.2.3
Description
Checks how widely SharePoint and OneDrive content can be shared outside the organisation. Technically: the tenant sharingCapability is disabled or restricted to existing guests; sharing open to new or anonymous users scores lower.
Rationale
Tenant-wide open sharing means any user can hand company files to any external address — the widest possible data-exposure surface, and where most accidental leaks start.
Audit
Orbit reads sharingCapability from GET /admin/sharepoint/settings. Disabled or existing-guests-only passes; new-guests-only is partial; anyone- with-the-link sharing is absent.
Remediation
SharePoint admin centre → Policies → Sharing → set the organisation-level external sharing slider; Set-SPOTenant -SharingCapability for scripted change.
Sharing restricted by domain medium Moderate
Description
Checks that external sharing, where allowed, is limited to known partner organisations. Technically: sharingDomainRestrictionMode is allowList or blockList (passes automatically if sharing is off entirely).
Rationale
Without domain restrictions, “external sharing” means sharing with literally any address — competitor, personal webmail or typo — rather than the partners you intend.
Audit
Orbit reads sharingDomainRestrictionMode from GET /admin/sharepoint/settings. Pass when a domain list is enforced or sharing is disabled; partial otherwise.
Remediation
SharePoint admin centre → Policies → Sharing → Limit external sharing by domain.
Guests can't reshare high Quick fix CIS 7.2.5
Description
Checks that external guests can't pass shared content on to further outsiders. Technically: isResharingByExternalUsersEnabled is false (passes if sharing is off entirely).
Rationale
Resharing lets access spread beyond the person you chose to trust — one guest forwards the link and the audience becomes unknowable.
Audit
Orbit reads isResharingByExternalUsersEnabled from GET /admin/sharepoint/settings. Pass when false or sharing is disabled; partial otherwise.
Remediation
SharePoint admin centre → Policies → Sharing → untick “Allow guests to share items they don't own”.
Guests must match the invited account medium Quick fix
Description
Checks that a sharing invitation can only be redeemed by the address it was sent to. Technically: isRequireAcceptingUserToMatchInvitedUserEnabled is true (passes if sharing is off entirely).
Rationale
Without enforcement, a forwarded invitation email is a bearer token: whoever receives it — not whoever you invited — gets the access.
Audit
Orbit reads isRequireAcceptingUserToMatchInvitedUserEnabled from GET /admin/sharepoint/settings. Pass when true or sharing is disabled; partial otherwise.
Remediation
SharePoint admin centre → Policies → Sharing → “Guests must sign in using the same account…”; Set-SPOTenant -RequireAcceptingAccountMatchInvitedAccount $true.
Tenant Security
Legacy authentication disabled critical Quick fix CIS 7.2.1 CE · User access control
Description
Checks that old sign-in protocols that skip modern security are blocked for SharePoint. Technically: isLegacyAuthProtocolsEnabled is false in the SharePoint tenant settings.
Rationale
Legacy protocols authenticate with only a username and password — no MFA, no Conditional Access — making them the standard route for password- spray and credential-stuffing attacks.
Audit
Orbit reads isLegacyAuthProtocolsEnabled from GET /admin/sharepoint/settings. Pass only when explicitly false; absent otherwise.
Remediation
SharePoint admin centre → Policies → Access control → Apps that don't use modern authentication → Block; Set-SPOTenant -LegacyAuthProtocolsEnabled $false.
Idle session sign-out enabled medium Quick fix CIS 1.3.2
Description
Checks that inactive SharePoint sessions on shared or unmanaged machines are signed out automatically. Technically: idleSessionSignOut.isEnabled is true.
Rationale
On a shared, library or home machine, an abandoned signed-in browser session hands the next user the previous user's files until the session dies of old age.
Audit
Orbit reads idleSessionSignOut from GET /admin/sharepoint/settings. Pass when enabled; partial otherwise.
Remediation
SharePoint admin centre → Policies → Access control → Idle session sign-out.
OneDrive sync restricted to managed devices high Moderate
Description
Checks that whole libraries can't be synced down to unmanaged personal computers. Technically: isUnmanagedSyncAppForTenantRestricted is true.
Rationale
The sync client copies entire document libraries to local disk; on an unmanaged device that's a full offline corporate data set outside encryption, wipe and DLP controls.
Audit
Orbit reads isUnmanagedSyncAppForTenantRestricted from GET /admin/sharepoint/settings. Pass when true; partial otherwise.
Remediation
SharePoint admin centre → Settings → OneDrive Sync → allow syncing only on domain-joined or compliant devices (Set- SPOTenantSyncClientRestriction).
Self-service site creation restricted medium Quick fix
Description
Checks that users can't create new SharePoint sites outside governance. Technically: isSiteCreationEnabled is false.
Rationale
Self-service sites appear with their own permissions and sharing settings and no owner accountability — content sprawl that security review never sees.
Audit
Orbit reads isSiteCreationEnabled from GET /admin/sharepoint/settings. Pass when false; partial otherwise.
Remediation
SharePoint admin centre → Settings → Site creation → turn off “Users can create SharePoint sites”.
Sites & Storage
No sites with 'Anyone' links critical Moderate CIS 7.2.7
Description
Checks that no site is sharing files via links that work for anybody on the internet. Technically: no active site reports anonymous (“Anyone”) links in the SharePoint usage report.
Rationale
An Anyone link is unauthenticated access: no sign-in, no audit trail of who used it, and it keeps working for whoever the URL reaches — forwarded, indexed or scraped.
Audit
Orbit reads the Anonymous Link Count per site from GET /reports/getSharePointSiteUsageDetail(period='D90') (beta — v1.0 omits link counts) and flags sites with any. Pass when none; partial otherwise.
Remediation
SharePoint admin centre → Sites → Active sites → review each flagged site's sharing links; tighten the site-level sharing setting to disallow Anyone links.
Sites shared with guests reviewed medium Moderate
Description
Checks which sites are currently shared with external guests, for regular review. Technically: active sites with a non-zero secure-guest- link count in the usage report.
Rationale
Guest links accumulate: access granted for a project outlives it, and each forgotten link is standing external access to internal content.
Audit
Orbit reads the Secure Link For Guest Count per site from GET /reports/getSharePointSiteUsageDetail(period='D90') (beta) and lists sites with guests. Pass when none; partial otherwise — a review prompt, not a fault.
Remediation
SharePoint admin centre → Sites → Active sites → review external access per flagged site.
No dormant sites low Moderate
Description
Checks for sites nobody has touched in three months. Technically: no active site's last activity date in the usage report is older than 90 days.
Rationale
Dormant sites keep their content shared and their permissions live with no active users to notice misuse — pure attack surface with no business value.
Audit
Orbit reads Last Activity Date per site from GET /reports/getSharePointSiteUsageDetail(period='D90') and flags sites inactive for over 90 days (or with no recorded activity). Pass when none; partial otherwise.
Remediation
SharePoint admin centre → Sites → Active sites → archive or delete dormant sites after owner review.
Sites within storage quota low Quick fix
Description
Checks that no site is about to hit its storage ceiling. Technically: no active site's storage used is 90% or more of its allocation.
Rationale
A site that hits quota stops accepting uploads — users hit save errors mid-work, and the failure looks like data loss until someone finds the cause.
Audit
Orbit compares Storage Used against Storage Allocated per site from GET /reports/getSharePointSiteUsageDetail(period='D90') and flags sites at 90% or above. Sites with no allocation recorded are skipped. Pass when none are near quota; partial otherwise.
Remediation
SharePoint admin centre → Sites → Active sites → raise the flagged sites' storage limit or archive content.
Exchange
Email Authentication
SPF record published on every domain high Quick fix CIS 2.1.8
Description
Checks that every email domain declares which servers may send mail as it. Technically: each verified custom domain publishes exactly one SPF (v=spf1) TXT record in public DNS.
Rationale
Without SPF, any server on the internet can send mail claiming to be your domain and receiving systems have no basis to reject it — the raw material of invoice fraud and phishing in your name.
Audit
Orbit queries public DNS (not Graph) for TXT records at each domain apex and requires exactly one v=spf1 record — multiple SPF records are invalid and flagged too. Domains come from GET /domains (verified, custom; onmicrosoft.com excluded). Domains whose DNS lookup fails are excluded from scoring, not failed.
Remediation
Add a TXT record at your DNS registrar, e.g. “v=spf1 include:spf.protection.outlook.com -all”; the Microsoft 365 admin centre's Domains page shows each domain's expected value. Open the admin centre.
SPF enforces hard fail (-all) medium Quick fix CIS 2.1.8
Description
Checks that the SPF record tells receivers to reject unauthorised senders outright. Technically: each SPF record ends in -all (hard fail) rather than ~all or a missing all mechanism.
Rationale
A soft-fail (~all) asks receivers merely to note forgeries rather than reject them; spoofed mail is delivered with only a spam-score nudge against it.
Audit
Orbit reads the final qualifier of each domain's SPF record from public DNS. All -all passes; ~all everywhere is partial; any domain with neither is scored against the population. Only domains that have SPF are evaluated.
Remediation
Edit the SPF TXT record at your registrar to end in -all once you've confirmed all legitimate senders are listed (check DMARC reports first to avoid breaking real mail). Open the admin centre.
DKIM signing configured for every domain high Quick fix CIS 2.1.9
Description
Checks that outgoing mail is cryptographically signed so receivers can verify it wasn't altered or forged. Technically: both Microsoft 365 DKIM selector records (selector1 and selector2) exist in each domain's DNS.
Rationale
Unsigned mail can be spoofed or altered in transit undetectably, and DMARC — the layer that actually blocks spoofing — can't reach enforcement without DKIM alignment.
Audit
Orbit queries public DNS for CNAME (or TXT) records at selector1._domainkey.<domain> and selector2._domainkey.<domain> and requires both. Domains signing with custom selector names would show as missing — a false positive to note.
Remediation
Microsoft Defender portal → Email authentication settings → DKIM → enable signing per domain, then publish the two CNAME records it gives you at your registrar. Open the admin centre.
DMARC record published on every domain high Quick fix CIS 2.1.10
Description
Checks that every domain tells the world what to do with mail that fails authentication. Technically: a v=DMARC1 TXT record exists at _dmarc.<domain> for each verified custom domain.
Rationale
Without DMARC, SPF and DKIM results are advisory — receivers have no instruction to quarantine or reject forgeries, and you get no reporting on who is spoofing your domain.
Audit
Orbit queries public DNS for a TXT record at _dmarc.<domain> per verified custom domain. Unreachable domains are excluded from scoring rather than failed.
Remediation
Add a TXT record at _dmarc.<domain> at your registrar, starting at “v=DMARC1; p=none; rua=mailto:…” to gather reports before enforcing. Open the admin centre.
DMARC policy set to quarantine or reject high Moderate CIS 2.1.10
Description
Checks that DMARC actually enforces rather than just monitors. Technically: each DMARC record's p= policy is quarantine or reject, not none.
Rationale
p=none means forged mail is still delivered; the domain is monitored but not protected. Only quarantine or reject makes receivers act on failures.
Audit
Orbit reads the p= tag of each domain's DMARC record from public DNS. All reject passes; quarantine anywhere (with no p=none) is partial; any p=none is scored against the population. Only domains with a DMARC record are evaluated.
Remediation
Edit the _dmarc TXT record at your registrar to p=quarantine, then p=reject once DMARC reports show legitimate mail aligning. Open the admin centre.
Mailbox Usage
No dormant mailboxes (90+ days) low Moderate
Description
Checks for mailboxes nobody has used in three months. Technically: no live mailbox in the usage report has a last-activity date older than 90 days.
Rationale
Dormant mailboxes are usually leavers' accounts that were never offboarded — still receiving mail, still licensable, and a quiet route back in for whoever retains the credentials.
Audit
Orbit reads GET /reports/getMailboxUsageDetail(period='D90') and flags non-deleted mailboxes with no activity in over 90 days (or none recorded). Pass when none; partial while at least 80% of mailboxes are active; absent beyond that. Usage reports lag by up to 48 hours.
Remediation
Exchange admin centre → Recipients → Mailboxes → convert leavers' mailboxes to shared, or remove them and reclaim the licence. Open the admin centre.
Mailboxes within storage quota medium Quick fix
Description
Checks that no mailbox is about to stop sending. Technically: no mailbox's storage used is at 90% or more of its prohibit-send quota.
Rationale
A mailbox that hits its send quota stops sending mid- conversation — for the user it's an outage, and for unattended mailboxes the failure can go unnoticed for days.
Audit
Orbit compares Storage Used against Prohibit Send Quota per mailbox from GET /reports/getMailboxUsageDetail(period='D90') and flags mailboxes at 90% or above. Pass when none; partial while they're under 20% of mailboxes; absent beyond that.
Remediation
Exchange admin centre → Recipients → Mailboxes → enable archiving for the flagged mailboxes or raise their quota. Open the admin centre.
Purview
Information Protection
Sensitivity labels are defined medium Moderate CIS 3.3.1
Description
Checks that the organisation has a way to mark documents and emails by confidentiality. Technically: at least one Microsoft Purview sensitivity label exists in the tenant.
Rationale
Without labels there is no machine-readable notion of what's confidential — encryption, sharing restrictions and DLP policies have nothing to key on, and every file is handled identically regardless of sensitivity.
Audit
Orbit reads GET /security/dataSecurityAndGovernance/sensitivityLabels and passes when any label exists; a readable but empty list is absent.
Remediation
Microsoft Purview portal → Information protection → Labels → create a label taxonomy and publish it. Open the admin centre.
Sensitivity labels are enabled medium Quick fix CIS 3.3.1
Description
Checks that the labels defined are actually switched on. Technically: every sensitivity label reports isEnabled (or isActive) as true.
Rationale
A disabled label is invisible to users — documents that should carry it go unlabelled, and any protection bound to it never applies.
Audit
Orbit reads the enabled state of each label from GET /security/dataSecurityAndGovernance/sensitivityLabels. Pass when all are enabled; partial while at least 80% are; absent beyond that. Only evaluated when labels exist.
Remediation
Microsoft Purview portal → Information protection → Labels → enable or delete the disabled labels. Open the admin centre.
Copilot
Licensing
Microsoft 365 Copilot is licensed low Quick fix
Description
Records whether the tenant owns Microsoft 365 Copilot licences. Technically: a subscribed SKU matching Microsoft 365 Copilot exists.
Rationale
Informational: the rest of the Copilot hub only means anything if Copilot is licensed, so this check anchors the report. It cannot fail — without the SKU the hub shows no checks at all.
Audit
Orbit reads GET /subscribedSkus and matches the Microsoft 365 Copilot SKU; the note carries the purchased-unit count.
Remediation
Microsoft 365 admin centre → Billing → Licenses (if you intend to buy Copilot; this check is informational). Open the admin centre.
Copilot licences are assigned low Quick fix
Description
Checks that purchased Copilot licences are actually given to users. Technically: the Copilot SKU's consumedUnits is above zero.
Rationale
An unassigned Copilot licence is roughly £25 per seat per month of pure waste — bought capability nobody can use.
Audit
Orbit reads consumedUnits on the Copilot SKU from GET /subscribedSkus. Pass when any are assigned; partial when all purchased seats sit unassigned.
Remediation
Microsoft 365 admin centre → Billing → Licenses → Microsoft 365 Copilot → assign to users. Open the admin centre.
Spare Copilot licences minimised medium Quick fix
Description
Checks that the tenant isn't paying for substantially more Copilot seats than it uses. Technically: spare units (purchased minus assigned) are within 10% of the purchased total (minimum headroom of one).
Rationale
Copilot's per-seat price makes over-purchase expensive fast; spare seats beyond sensible headroom are recurring spend with zero return.
Audit
Orbit computes prepaidUnits.enabled minus consumedUnits on the Copilot SKU from GET /subscribedSkus and flags spare seats above the 10% allowance. Pass within allowance; partial beyond it.
Remediation
Microsoft 365 admin centre → Billing → Your products → reduce the Copilot seat count at renewal, or assign the spares. Open the admin centre.
Adoption
Assigned licences are being used medium Moderate
Description
Checks that people given Copilot actually use it. Technically: every licensed user in the Copilot usage report shows activity within the last 28 days.
Rationale
A licence assigned to someone who never uses it is the same waste as an unassigned one, hidden from the licence count — reclaiming or re- seating it is free money.
Audit
Orbit reads last-activity dates from GET /reports/getMicrosoft365CopilotUsageUserDetail(period='D90') (beta) and flags users inactive for over 28 days. Pass when none; partial while inactive users are a minority; absent beyond half. Usage reports lag by up to 48 hours.
Remediation
Microsoft 365 admin centre → Copilot → review usage; reassign dormant seats or run adoption training. Open the admin centre.
Copilot used across multiple apps low Moderate
Description
Checks that Copilot use has spread beyond a single app. Technically: at least three of the reported apps (Teams, Outlook, Word, Excel, PowerPoint, OneNote, Loop, Chat) show an active user in the last 90 days.
Rationale
Copilot confined to one app usually signals a stalled rollout — the licence cost is justified across the suite, not by Teams summaries alone.
Audit
Orbit reads the per-app last-activity columns of the Copilot usage report and counts apps with at least one active user. Pass at three or more; partial below.
Remediation
Microsoft 365 admin centre → Copilot → adoption resources; target training at the unused apps. Open the admin centre.
Copilot Chat in active use low Quick fix
Description
Checks that the standalone Copilot Chat is being used at all. Technically: at least one user shows Copilot Chat activity in the usage report.
Rationale
Chat is the broadest-value Copilot surface and needs no per- document context; zero usage indicates users don't know it exists.
Audit
Orbit reads the Copilot Chat last-activity column of the usage report; pass when any user is active, partial when none.
Remediation
Microsoft 365 admin centre → Copilot → promote Copilot Chat availability to licensed users. Open the admin centre.
Licensing
Assignment
No licences on disabled accounts medium Quick fix
Description
Checks that blocked or offboarded accounts aren't still consuming paid licences. Technically: no user with accountEnabled false holds any assigned licence.
Rationale
Licences on disabled accounts are pure recurring waste — the standard leaver process disables sign-in but forgets the licence, which then bills indefinitely.
Audit
Orbit reads accountEnabled and assignedLicenses per user from GET /users and flags disabled licence-holders. Pass when none; partial while they're a minority of licensed users; absent beyond half.
Remediation
Microsoft 365 admin centre → Billing → Licenses → remove licences from the flagged accounts (after mailbox/data handover). Open the admin centre.
No licences on guest accounts medium Quick fix
Description
Checks that external guest accounts aren't holding paid licences. Technically: no user with userType Guest holds an assigned licence.
Rationale
Guests rarely need licences — their own organisation licenses them — so a licensed guest is usually a mistake paying an outsider's way.
Audit
Orbit reads userType and assignedLicenses per user from GET /users and flags licensed guests. Pass when none; partial while a minority; absent beyond half.
Remediation
Microsoft 365 admin centre → Billing → Licenses → review and remove licences from guest accounts. Open the admin centre.
Unassigned licences minimised medium Quick fix
Description
Checks for purchased licences sitting on the shelf. Technically: across all SKUs, prepaidUnits.enabled minus consumedUnits totals zero.
Rationale
Every unassigned seat is subscription spend with no user attached; across several SKUs the waste compounds quietly at every renewal.
Audit
Orbit sums spare units per SKU from GET /subscribedSkus. Pass at zero spare; partial otherwise, listing the spare count per SKU.
Remediation
Microsoft 365 admin centre → Billing → Your products → reduce seat counts at renewal or assign the spares. Open the admin centre.
No licences in a warning or suspended state high Quick fix
Description
Checks that no subscription is in a billing-failure state. Technically: no SKU reports units in prepaidUnits.warning, suspended or lockedOut.
Rationale
Warning and suspended states precede service shutdown: users lose mail and files access on Microsoft's timetable, not yours, unless billing is fixed first.
Audit
Orbit reads prepaidUnits per SKU from GET /subscribedSkus and flags any units in warning, suspended or locked-out states. Pass when none; partial otherwise.
Remediation
Microsoft 365 admin centre → Billing → Your products → resolve the payment or renewal issue on the flagged subscription. Open the admin centre.
Utilisation
Licensed users are active medium Moderate
Description
Checks that people holding licences actually sign in. Technically: every enabled licensed user has a sign-in within the last 90 days.
Rationale
A licence on an account nobody signs into is spend without use — commonly a role change, long-term leave or an incomplete leaver process.
Audit
Orbit reads signInActivity per user from GET /users (requires Entra ID P1; without it this report shows an error rather than guessing) and flags licensed users inactive for over 90 days. Pass when none; partial while at least 80% are active; absent beyond that.
Remediation
Microsoft 365 admin centre → Billing → Licenses → reclaim licences from long-inactive users. Open the admin centre.
No premium licences on inactive users high Quick fix
Description
Checks that the most expensive licences aren't parked on dormant accounts. Technically: no user inactive for 90+ days holds a premium SKU (E5 and equivalents).
Rationale
Premium seats cost several times a standard licence; on a dormant account the premium increment is the single biggest per-user saving available.
Audit
Orbit cross-references inactive users (signInActivity, 90-day threshold) against premium SKU assignments resolved via GET /subscribedSkus. Pass when none; partial while at least 80% comply; absent beyond that.
Remediation
Microsoft 365 admin centre → Billing → Licenses → downgrade or reclaim premium licences on the flagged accounts. Open the admin centre.
Framework references: CIS & Cyber Essentials
Where a check corresponds to a recognised framework control, it carries a reference chip:
- CIS 5.2.2.3 — the CIS Microsoft 365 Foundations Benchmark v7.0.0. The chip shows the recommendation ID on the same subject as the check.
- CE · User access control — Cyber Essentials. The chip names which of Cyber Essentials' five technical control areas (firewalls, secure configuration, security update management, user access control, malware protection) the check evidences. Thirty-five checks carry one: MFA coverage and account hygiene, password, passwordless and lockout policy, device compliance and baselines, update management, antivirus and firewall policy. Cyber Essentials Plus tests the same five controls with independent verification.
Three rules apply to every chip:
- Nearest control, not equivalence. The chip points to the framework requirement on the same subject; Orbit's exact thresholds aren't always identical, and a passing check is never certification evidence. Cyber Essentials assessment covers devices and scope beyond what a 365 tenant can show.
- Control identifiers only. Orbit references CIS recommendation IDs and CE control-area names; the CIS benchmark itself is CIS's copyrighted work, available free from cisecurity.org, and the Cyber Essentials requirements are published by the NCSC.
- No chip means no honest anchor. Some checks have no counterpart: Intune depth lives in CIS's separate Intune benchmark, licensing and adoption checks are cost governance rather than security controls, and Cyber Essentials doesn't require things like disk encryption, EDR or phishing-resistant MFA, so those checks don't claim it. Orbit doesn't stretch a mapping to fill the gap.
Terms of service
Orbit is provided by Planet IT. By signing in and using the service you agree to these terms.
Orbit reports scores and findings on your Microsoft 365 tenant's configuration (the Scoring tab describes how). Its output is guidance to act on, not certification or a guarantee of security. Access is read-only and revocable at any time in Microsoft Entra — the exact scopes are on the Permissions tab, and everything Orbit stores, with retention periods, is on the Your data tab. You may only connect tenants you're authorised to administer.
The free trial includes your overall tenant health score and the full Entra ID hub; full access comes with a subscription agreed with Planet IT, and may be paused if a subscription lapses. Orbit depends on Microsoft's APIs and is provided without an uptime guarantee — when a data source can't be read, your reports say so rather than guessing. Questions about these terms: planet-it.net/contact.
Planet IT is an outsourced IT provider based at Milton Park, Oxfordshire, supporting organisations across the UK and Europe with a team of more than fifty engineers and developers and 24-hour cover.
Orbit is built and run by Planet IT; its checks encode the Microsoft configuration standards Planet IT's engineers apply in client tenants.
- Accreditations. ISO 27001 certified, Cyber Essentials Plus assessed, and ranked a Best Company 2025.
- Microsoft Solutions Partner. Designations for Security, Modern Work and Infrastructure (Azure).
- Services. Managed and co-managed IT support, security, backup and disaster recovery, cloud infrastructure, professional services and automation.
