Documentation
How scoring works
Orbit runs over 200 checks across eight hubs: Entra ID, Intune, Teams, SharePoint, Exchange, Purview, Copilot and Licensing. Each check compares your tenant with Microsoft's recommendations. The Checks tab shows what each check inspects and where to fix it. The framework references are further down this tab.
Check results
| Result | Meaning | Points earned |
|---|---|---|
| pass | Meets the recommended configuration. | Full points |
| partial | The right control exists but is narrower or weaker than recommended. | Half points |
| failure | The control is missing. | None |
| not licensed | Your licences don't include this feature (e.g. Entra ID P2 risk policies on a Business Premium tenant). Shown for reference and not scored. You never lose points for a feature your licences don't include. | Excluded |
Severity weighting
| Severity | Weight | Typically |
|---|---|---|
| critical | ×4 | Identity takeover and data-exposure controls: MFA coverage, legacy authentication, admin count, encryption, anonymous sharing. |
| high | ×3 | Strong hardening: phishing-resistant methods, risk policies, email authentication, endpoint security policies. |
| medium | ×2 | Governance: expiry policies, guest governance, update profiles. |
| low | ×1 | Hygiene: naming policies, empty groups, dormant content. |
Effort labels
| Label | Meaning |
|---|---|
| Quick fix | A settings toggle in the admin centre — minutes. |
| Moderate | A policy that needs planning, piloting or a rollout — days. |
| Project | A structural change (e.g. separating admin accounts) — weeks. |
Framework references: CIS & Cyber Essentials
Where a check corresponds to a recognised framework control, it carries a reference chip:
- CIS 5.2.2.3 — the CIS Microsoft 365 Foundations Benchmark v7.0.0. The chip shows the recommendation ID on the same subject as the check.
- CE · User access control — Cyber Essentials. The chip names the Cyber Essentials technical control area that the check supports. There are five: firewalls, secure configuration, security update management, user access control and malware protection. Fifty-six checks carry one. They cover MFA and account hygiene; privileged and partner access; password, passwordless and lockout policy; device compliance and baselines; update management; antivirus and firewall policy; and email and Teams protection (anti-phishing, attachment filtering, Safe Links, external access). Cyber Essentials Plus tests the same five controls with independent verification.
Two rules apply to every chip:
- Nearest control, not an exact match. The chip points to the framework requirement on the same subject. Orbit's thresholds can differ. A passing check is never certification evidence. A Cyber Essentials assessment covers devices and scope that a Microsoft 365 tenant can't show.
- Control identifiers only. Orbit references CIS recommendation IDs and CE control-area names. The CIS benchmark itself is CIS's copyrighted work, available free from cisecurity.org. The NCSC publishes the Cyber Essentials requirements.
Check reference
Every check Orbit runs: what it inspects, why it matters, exactly what Orbit reads to evaluate it, and where to fix it. Severity, effort and framework chips match the ones in your reports. Expand a check for its full entry.
Entra ID
Conditional Access
Require MFA for all users critical Moderate CIS 5.2.2.2 CE · User access control
What it checks
Checks that every user must prove their identity with a second factor when signing in. Technically: an enabled Conditional Access policy includes all users and all applications and grants access only with MFA (or an authentication strength).
Why it matters
Without enforced MFA, one guessed, phished or leaked password is enough to take over an account. Microsoft attributes the overwhelming majority of account compromises to this gap.
What Orbit reads
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled policy scoped to All users with an MFA grant. Pass when it also covers all applications; partial when scoped narrower (or when Security Defaults provide the equivalent). Orbit doesn't recognise a policy that targets "all users" through a group instead of the All keyword. This is a known false positive.
How to fix it
Microsoft Entra admin centre → Protection → Conditional Access → Policies → create a policy: All users, All resources, Grant → Require multifactor authentication. Open the admin centre.
Block legacy authentication critical Quick fix CIS 5.2.2.3 CE · User access control
What it checks
Checks that old sign-in protocols that can't do MFA are blocked. Technically: an enabled Conditional Access policy targets the legacy client-app types (Exchange ActiveSync and other clients) with a Block grant.
Why it matters
Legacy authentication bypasses MFA entirely. It is the most common way attackers first get into Microsoft 365, and password-spray campaigns target it specifically.
What Orbit reads
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled block policy whose client-app conditions are exactly the legacy types. Pass when scoped to All users (Security Defaults also count); partial when narrower. Also partial when the policy targets no cloud app or user action, because an empty application condition blocks nothing. The same empty-policy rule applies to the guest-MFA, sign-in-risk, user-risk, device-code and app-protection checks.
How to fix it
Microsoft Entra admin centre → Protection → Conditional Access → Policies → create a policy: All users, Conditions → Client apps → Exchange ActiveSync clients + Other clients, Grant → Block access. Open the admin centre.
Phishing-resistant MFA for admins high Moderate CIS 5.2.2.5
What it checks
Checks that administrator sign-ins require credentials that can't be phished. Technically: an enabled Conditional Access policy targets directory roles and grants access via an authentication strength.
Why it matters
Admin accounts are the highest-value phishing targets. An attacker can relay a standard MFA prompt, or send prompts until the admin approves one. A phishing site can't replay FIDO2 or certificate-based credentials.
What Orbit reads
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled policy with role-based inclusions. Pass when it grants via an authentication strength; partial when it requires only standard MFA. Orbit doesn't verify the strength selected is the phishing-resistant one.
How to fix it
Microsoft Entra admin centre → Protection → Conditional Access → Policies → target Directory roles → Grant → Require authentication strength → Phishing-resistant MFA. Open the admin centre.
Emergency access accounts excluded medium Quick fix CIS 1.1.2
What it checks
Checks that break-glass accounts are excluded from the policies that could lock everyone out. Technically: every enabled Conditional Access policy applying to all users carries user or group exclusions.
Why it matters
If a misconfigured MFA or block policy catches every admin, the tenant has no way back in. Recovery means a support case that takes days. During that time nobody can administer the tenant.
What Orbit reads
Orbit reads GET /identity/conditionalAccess/policies and checks each broad (all-users) policy for exclusions. Pass when all have them; partial when only some do. Any exclusion counts, because Orbit can't verify that the excluded account is a genuine break-glass account.
How to fix it
Microsoft Entra admin centre → Protection → Conditional Access → Policies → exclude a dedicated emergency-access account (cloud-only, strong credential, monitored) from each broad policy. Open the admin centre.
Secure security-info registration high Moderate CIS 5.2.2.10
What it checks
Checks that setting up MFA methods is itself protected. Technically: an enabled Conditional Access policy targets the "Register security information" user action and requires MFA.
Why it matters
If security-info registration is unprotected, an attacker with a stolen password can enrol their own MFA method. The account's MFA then works for the attacker.
What Orbit reads
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled policy whose user actions include urn:user:registersecurityinfo with an MFA grant. The result is pass or failure. There is no partial result.
How to fix it
Microsoft Entra admin centre → Protection → Conditional Access → Policies → target User actions → Register security information → Grant → Require multifactor authentication. Open the admin centre.
Require MFA for guests high Quick fix CE · User access control
What it checks
Checks that external guest users face MFA like everyone else. Technically: an enabled Conditional Access policy requiring MFA targets guests and external users (an all-users MFA policy also satisfies this).
Why it matters
A guest account is only as secure as the guest's home tenant. Without your own MFA requirement, a password compromised there gives access to your tenant.
What Orbit reads
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled MFA policy scoped to GuestsOrExternalUsers or All users. The result is pass or failure. There is no partial result.
How to fix it
Microsoft Entra admin centre → Protection → Conditional Access → Policies → target Guest or external users → Grant → Require multifactor authentication. Open the admin centre.
Approved app / app protection on mobile medium Moderate
What it checks
Checks that mobile access to company data is only allowed through apps the organisation controls. Technically: an enabled Conditional Access policy grants access on the approved-app or app-protection-policy control.
Why it matters
Without it, any mail client on any phone can sync corporate mailboxes. That mail is then outside app protection, selective wipe and data-transfer controls.
What Orbit reads
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled policy granting via approvedApplication or compliantApplication. Pass when its platform condition covers Android and iOS; partial when no mobile platform condition is set. Also partial when the policy targets no cloud app or user action: an enabled policy with an empty application condition matches no sign-in, so its grant never applies.
How to fix it
Microsoft Entra admin centre → Protection → Conditional Access → Policies → Conditions → Device platforms → Android/iOS, Grant → Require approved client app or app protection policy. Open the admin centre.
Require MFA for device registration medium Quick fix
What it checks
Checks that joining a device to the directory requires MFA. Technically: an enabled Conditional Access policy targets the "Register or join devices" user action with an MFA grant.
Why it matters
If device registration needs only a password, an attacker who has the password can register a device they control. They can then use it to satisfy device-based trust elsewhere.
What Orbit reads
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled policy whose user actions include urn:user:registerdevice with an MFA grant. The result is pass or failure. There is no partial result.
How to fix it
Microsoft Entra admin centre → Protection → Conditional Access → Policies → target User actions → Register or join devices → Grant → Require multifactor authentication. Open the admin centre.
Sign-in risk policy (high-risk sign-ins) high Moderate CIS 5.2.2.7
What it checks
Checks that suspicious sign-ins are automatically challenged. Technically: an enabled Conditional Access policy has sign-in risk levels configured and responds with MFA or block. Requires Entra ID P2.
Why it matters
Identity Protection flags sign-ins from anonymised networks, impossible travel and leaked credentials in real time. Without a policy attached, each detection is only a log entry and stops nothing.
What Orbit reads
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled policy with non-empty signInRiskLevels and an MFA or block grant. On tenants without P2, Orbit shows the check as not licensed and excludes it from scoring.
How to fix it
Microsoft Entra admin centre → Protection → Conditional Access → Policies → Conditions → Sign-in risk → High (and Medium), Grant → Require multifactor authentication or Block. Open the admin centre.
User risk policy (high-risk users) high Moderate CIS 5.2.2.6
What it checks
Checks that accounts Microsoft believes are compromised are automatically remediated. Technically: an enabled Conditional Access policy has user risk levels configured and responds with password change, MFA or block. Requires Entra ID P2.
Why it matters
A high user-risk score means Microsoft has evidence the account's credential is compromised. Typically the credential was found in a breach dump. Without a policy, that account keeps working until a human notices.
What Orbit reads
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled policy with non-empty userRiskLevels granting password change, MFA or block. On tenants without P2, Orbit shows the check as not licensed and excludes it from scoring.
How to fix it
Microsoft Entra admin centre → Protection → Conditional Access → Policies → Conditions → User risk → High, Grant → Require password change. Open the admin centre.
Device code sign-in flow blocked high Quick fix CIS 5.2.2.12
What it checks
Checks that a Conditional Access policy blocks the device code sign-in flow. Technically: an enabled policy whose authentication-flows condition includes deviceCodeFlow with a block grant; full marks when it covers all users.
Why it matters
Device code sign-in exists for devices without a keyboard. Attackers abuse it: they start the flow themselves and talk the victim into approving it. The attacker gets a session and no password is ever typed. Almost no organisation needs the flow enabled for everyone.
What Orbit reads
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled block policy on the deviceCodeFlow transfer method. Pass when it targets all users; partial when narrower; failure when no policy blocks the flow.
How to fix it
Microsoft Entra admin centre → Protection → Conditional Access → New policy → Conditions → Authentication flows → Device code flow → Block. Open the admin centre.
Admin sessions require periodic reauthentication medium Moderate CIS 5.2.2.4
What it checks
Checks that administrator sessions expire. Technically: an enabled Conditional Access policy targets directory roles, sets a sign-in frequency and sets browser sessions to never persist. One of the two settings alone scores partial.
Why it matters
A stolen admin session token is as good as the password. Without a sign-in frequency it works indefinitely. Bounding session lifetime for privileged roles limits how long a hijacked session stays useful.
What Orbit reads
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled role-targeted policy with signInFrequency enabled and persistentBrowser set to never. Pass with both; partial with one; failure with neither.
How to fix it
Microsoft Entra admin centre → Protection → Conditional Access → New policy → target directory roles → Session → Sign-in frequency and Persistent browser session → Never persistent. Open the admin centre.
Authentication transfer blocked medium Quick fix CE · User access control
What it checks
Checks that the authentication transfer flow is blocked. This flow moves a signed-in session to another device by scanning a QR code. Technically: an enabled Conditional Access policy whose authentication-flows condition includes authenticationTransfer with a Block grant.
Why it matters
Authentication transfer is the same social-engineering channel as device code flow. An attacker starts the transfer and talks the victim into completing it. The attacker then has a fully authenticated session on their own device.
What Orbit reads
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled policy whose transferMethods include authenticationTransfer with a Block grant. Pass when it covers all users and targets a resource; partial when scoped narrower or targeting nothing.
How to fix it
Microsoft Entra admin centre → Protection → Conditional Access → New policy → Conditions → Authentication flows → Authentication transfer → Grant → Block access. You can put the device-code block and the transfer block in one policy. Open the admin centre.
Require compliant or hybrid-joined devices high Moderate CE · User access control
What it checks
Checks that access requires a managed device, not just a correct password and MFA. Technically: an enabled Conditional Access policy granting access only with the Require device to be marked as compliant (or Microsoft Entra hybrid joined device) control.
Why it matters
Attackers can phish credentials and even MFA approvals. With a compliant-device requirement, a stolen identity is useless without company-managed hardware. This stops attackers replaying tokens from their own systems.
What Orbit reads
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled policy granting compliantDevice or domainJoinedDevice. Pass when it covers all users and all applications; partial when scoped narrower or targeting nothing.
How to fix it
Microsoft Entra admin centre → Protection → Conditional Access → New policy → All users, All resources → Grant → Require device to be marked as compliant. Pilot with a group first, because this control locks out unmanaged devices by design. Open the admin centre.
Token protection for sign-in sessions medium Moderate CE · User access control
What it checks
Checks that sign-in session tokens are cryptographically bound to the device they were issued to. Technically: an enabled Conditional Access policy with the Require token protection for sign-in sessions session control.
Why it matters
Token theft bypasses both passwords and MFA. A stolen token replayed from the attacker's machine inherits the victim's whole session. Token protection makes a stolen token unusable off the original device.
What Orbit reads
Orbit reads GET /identity/conditionalAccess/policies and looks for an enabled policy whose session controls enable secureSignInSession. Pass when it targets a resource; partial when it targets nothing. Token protection currently supports selected platforms and apps, so Microsoft's deployment guidance recommends pairing it with compliant-device and unknown-platform policies.
How to fix it
Microsoft Entra admin centre → Protection → Conditional Access → New policy → Session → Require token protection for sign-in sessions. Start in report-only and review sign-in logs before enforcing. Open the admin centre.
No stale Conditional Access policies medium Quick fix CE · Secure configuration
What it checks
Checks that old disabled or report-only policies have been cleaned up. Technically: no policy in the disabled or report-only state was last modified more than 90 days ago.
Why it matters
A policy left in report-only for months is a control that someone planned but never turned on. It protects nothing. Old disabled policies also build up as clutter. They make the live policies harder to understand and riskier to change.
What Orbit reads
Orbit reads GET /identity/conditionalAccess/policies and flags policies whose state is disabled or enabledForReportingButNotEnforced and whose modifiedDateTime (or creation date) is over 90 days old. Pass with none; partial with one or two; failure with three or more. Orbit doesn't flag a policy with no readable timestamp.
How to fix it
Microsoft Entra admin centre → Protection → Conditional Access → Policies → for each stale policy, either finish the rollout (switch report-only to On) or delete it. Open the admin centre.
Named locations defined low Quick fix CE · Secure configuration
What it checks
Checks that named locations (trusted IP ranges or allowed countries) are defined and used. Technically: at least one entry under Conditional Access named locations, referenced by an enabled policy's location condition.
Why it matters
Location conditions are the foundation for geo-fencing and impossible-travel defences. Several stronger policies need locations first, for example a block on sign-ins from countries you never operate in.
What Orbit reads
Orbit reads GET /identity/conditionalAccess/namedLocations. Pass when locations exist and an enabled policy references one. A policy that uses the All trusted locations keyword also counts, if a trusted location is defined. Partial when locations exist but nothing references them; failure with none.
How to fix it
Microsoft Entra admin centre → Protection → Conditional Access → Named locations → add your trusted IP ranges and operating countries, then reference them from a policy's Locations condition. Open the admin centre.
Password Management
Password expiration disabled (no forced expiry) medium Quick fix CIS 1.3.1 CE · User access control
What it checks
Checks that users aren't forced to change passwords on a timer. Technically: every verified domain's passwordValidityPeriodInDays is set to never expire.
Why it matters
Forced rotation produces predictable increments (Password1 → Password2) and more helpdesk resets, not more security. Microsoft and NCSC guidance both say to turn expiry off when MFA and banned-password checks are in place.
What Orbit reads
Orbit reads passwordValidityPeriodInDays per verified domain from GET /domains. Pass when all domains never expire passwords; failure when any forces expiry.
How to fix it
Microsoft 365 admin centre → Settings → Org settings → Security & privacy → Password expiration policy → set passwords to never expire. Open the admin centre.
Microsoft global banned password list medium Quick fix CE · User access control
What it checks
Records that Microsoft's global banned-password list applies to cloud accounts. Technically: Entra ID evaluates every cloud password change against Microsoft's global list; this cannot be disabled.
Why it matters
The global list blocks the passwords attackers try first. This check is for information only. It always passes for cloud accounts, and gives context to the two configurable checks beside it.
What Orbit reads
Orbit doesn't read this from the tenant. The global list is always on for cloud accounts, so Orbit records a pass.
How to fix it
Nothing to do. See the custom banned list and on-premises protection checks for the parts you can configure. Open the admin centre.
Custom banned password list configured low Quick fix CIS 5.2.3.2 CE · User access control
What it checks
Checks that the organisation blocks its own predictable passwords, such as the company name, products and local sports teams. Technically: the Password Rule Settings directory setting has EnableBannedPasswordCheck true and a non-empty BannedPasswordList.
Why it matters
Attackers seed password sprays with the company name and variations. The global list can't know your brand words. Without a custom list, those words remain valid passwords.
What Orbit reads
Orbit reads the Password Rule Settings values from GET /groupSettings. Pass when the check is enabled with a populated list; partial when only one of the two is set; failure when neither.
How to fix it
Microsoft Entra admin centre → Protection → Authentication methods → Password protection → Custom banned password list. Open the admin centre.
On-premises password protection set to Enforced medium Moderate CIS 5.2.3.3 CE · User access control
What it checks
Checks that banned-password rules also apply to on-premises Active Directory password changes. Technically: EnableBannedPasswordCheckOnPremises is true with BannedPasswordCheckOnPremisesMode set to Enforce. Evaluated only for hybrid tenants.
Why it matters
In a hybrid tenant, most passwords are set in AD. If protection stops at the cloud, AD still accepts the passwords that the cloud bans.
What Orbit reads
Orbit reads the Password Rule Settings values from GET /groupSettings, and GET /organization to detect hybrid sync. Pass when enforced; partial when enabled in audit mode only; failure when off. Orbit skips the check for cloud-only tenants.
How to fix it
Microsoft Entra admin centre → Protection → Authentication methods → Password protection → set Mode to Enforced (requires the on-premises agents deployed on domain controllers). Open the admin centre.
Smart lockout threshold of 10 or fewer low Quick fix CIS 5.2.3.8 CE · User access control
What it checks
Checks that repeated wrong passwords lock an account quickly. Technically: the smart-lockout LockoutThreshold is 10 or fewer failed attempts.
Why it matters
A high threshold gives password-spray and brute-force attacks more free guesses per account before anything slows them down.
What Orbit reads
Orbit reads LockoutThreshold from the Password Rule Settings values in GET /groupSettings, assuming Microsoft's default of 10 when unset. Pass at 10 or fewer; partial above.
How to fix it
Microsoft Entra admin centre → Protection → Authentication methods → Password protection → Lockout threshold. Open the admin centre.
Lockout duration of 60 seconds or more low Quick fix CIS 5.2.3.9 CE · User access control
What it checks
Checks that a locked account stays locked long enough to blunt automated guessing. Technically: LockoutDurationInSeconds is at least 60.
Why it matters
A short lockout barely interrupts an automated attack. The tooling simply waits it out and resumes at full speed.
What Orbit reads
Orbit reads LockoutDurationInSeconds from the Password Rule Settings values in GET /groupSettings, assuming the default of 60 when unset. Pass at 60 or more; partial below.
How to fix it
Microsoft Entra admin centre → Protection → Authentication methods → Password protection → Lockout duration in seconds. Open the admin centre.
Passwordless methods enabled (Authenticator / FIDO2) high Moderate CE · User access control
What it checks
Checks that users can sign in without a password at all. Technically: the FIDO2 or Microsoft Authenticator method is enabled in the authentication methods policy.
Why it matters
Passwords are the credential that attackers obtain. Until passwordless methods are available, every account still depends on a password that can be phished.
What Orbit reads
Orbit reads authenticationMethodConfigurations from GET /policies/authenticationMethodsPolicy and passes when Fido2 or MicrosoftAuthenticator is enabled; failure when neither.
How to fix it
Microsoft Entra admin centre → Protection → Authentication methods → Policies → enable Passkey (FIDO2) and Microsoft Authenticator. Open the admin centre.
Authenticator registration campaign running medium Quick fix
What it checks
Checks that users still on weaker MFA methods are being nudged to Microsoft Authenticator. Technically: the registration campaign in the authentication methods policy is enabled.
Why it matters
Users don't move off SMS by themselves. Without the campaign, the number of users on phishable methods falls only when staff leave.
What Orbit reads
Orbit reads registrationEnforcement.authenticationMethodsRegistrationCampaign from GET /policies/authenticationMethodsPolicy. Pass when the campaign is enabled and Microsoft Authenticator is also enabled in the methods policy. Partial when the campaign is enabled but Authenticator is disabled, because nobody is then eligible for the nudge. Failure when the campaign is off.
How to fix it
Microsoft Entra admin centre → Protection → Authentication methods → Registration campaign → Enable. Open the admin centre.
Non-expiring passwords are backed by MFA high Moderate
What it checks
Checks that accounts exempted from password expiry have a second factor. Technically: no enabled member account carries DisablePasswordExpiration while having no registered MFA method.
Why it matters
Current Microsoft and NCSC guidance accepts a non-expiring password, but only with MFA behind it. Without a second factor, a single static credential guards the account indefinitely.
What Orbit reads
Orbit reads passwordPolicies from GET /users and joins it to MFA registration (GET /reports/authenticationMethods/userRegistrationDetails) on user id. It counts enabled member accounts that have the expiry exemption and no registered method. The score is proportional to the number of exempted accounts. Orbit leaves the check out when no account carries the exemption.
How to fix it
Microsoft Entra admin centre → Identity → Users → either register the account for MFA, or remove its password-expiry exemption with Update-MgUser -PasswordPolicies None. Registering MFA is the better fix. Open the admin centre.
Authentication Methods
Phishing-resistant method enabled (FIDO2 or certificate-based) high Moderate
What it checks
Checks that at least one unphishable sign-in method is available to users. Technically: the FIDO2 or X509Certificate method is enabled in the authentication methods policy.
Why it matters
Attackers can phish push and code-based MFA in real time, or wear a user down with repeated prompts. Until the tenant has a phishing-resistant method, an attacker can relay every MFA prompt.
What Orbit reads
Orbit reads the method states from GET /policies/authenticationMethodsPolicy. Pass when Fido2 or X509Certificate is enabled; partial otherwise. The result is never a failure, because MFA exists but relies on phishable methods.
How to fix it
Microsoft Entra admin centre → Protection → Authentication methods → Policies → enable Passkey (FIDO2) or Certificate-based authentication. Open the admin centre.
SMS not used for authentication high Moderate CIS 5.2.3.5
What it checks
Checks that text-message sign-in codes are turned off. Technically: the Sms method in the authentication methods policy is not enabled.
Why it matters
Attackers can intercept SMS codes with SIM-swap and SS7-level attacks, and phish them like any typed code. SMS is the weakest MFA method still in common use.
What Orbit reads
Orbit reads the Sms method state from GET /policies/authenticationMethodsPolicy. Pass when disabled; partial when enabled.
How to fix it
Microsoft Entra admin centre → Protection → Authentication methods → Policies → Sms → disable, after migrating registered users. Open the admin centre.
Voice call not used for authentication medium Moderate CIS 5.2.3.5
What it checks
Checks that phone-call approval for sign-in is turned off. Technically: the Voice method in the authentication methods policy is not enabled.
Why it matters
Voice approval shares SMS's interception weaknesses and trains users to approve calls they didn't initiate.
What Orbit reads
Orbit reads the Voice method state from GET /policies/authenticationMethodsPolicy. Pass when disabled; partial when enabled.
How to fix it
Microsoft Entra admin centre → Protection → Authentication methods → Policies → Voice call → disable. Open the admin centre.
Email OTP not used for authentication medium Quick fix CIS 5.2.3.7
What it checks
Checks that emailed one-time codes aren't used for sign-in. Technically: the Email method in the authentication methods policy is not enabled.
Why it matters
Email OTP protects an account with another account. That mailbox often has a weaker password and no MFA, and it becomes the real line of defence.
What Orbit reads
Orbit reads the Email method state from GET /policies/authenticationMethodsPolicy. Pass when disabled; partial when enabled.
How to fix it
Microsoft Entra admin centre → Protection → Authentication methods → Policies → Email OTP → disable. Open the admin centre.
System-preferred MFA enabled medium Quick fix CIS 5.2.3.6
What it checks
Checks that sign-ins automatically use the strongest MFA method each user has registered. Technically: systemCredentialPreferences in the authentication methods policy is enabled (or default).
Why it matters
Without system-preferred MFA, a user registered for both Authenticator and SMS keeps getting prompts from the method they chose first. That is usually the weaker one.
What Orbit reads
Orbit reads systemCredentialPreferences.state from GET /policies/authenticationMethodsPolicy. Pass when enabled or default; partial when disabled.
How to fix it
Microsoft Entra admin centre → Protection → Authentication methods → Settings → System-preferred multifactor authentication → Enable. Open the admin centre.
Authentication methods migration complete medium Moderate
What it checks
Checks that MFA settings are managed in one place rather than three. Technically: the authentication methods policy's policyMigrationState is migrationComplete.
Why it matters
Until migration completes, the legacy per-user MFA and SSPR policies still apply in parallel. Methods you disabled in the modern policy can stay live through the legacy ones.
What Orbit reads
Orbit reads policyMigrationState from GET /policies/authenticationMethodsPolicy. Pass when migrationComplete; partial otherwise.
How to fix it
Microsoft Entra admin centre → Protection → Authentication methods → Policies → Manage migration → complete the guided migration. Open the admin centre.
Temporary Access Pass enabled low Quick fix
What it checks
Checks that admins can issue time-limited credentials for onboarding and recovery. Technically: the TemporaryAccessPass method is enabled in the authentication methods policy.
Why it matters
Without TAP, you need insecure workarounds to set up a passwordless user or recover a lost credential. A typical one is a temporary password that the helpdesk sets and sends over chat.
What Orbit reads
Orbit reads the TemporaryAccessPass method state from GET /policies/authenticationMethodsPolicy. Pass when enabled; partial otherwise.
How to fix it
Microsoft Entra admin centre → Protection → Authentication methods → Policies → Temporary Access Pass → Enable. Open the admin centre.
Authenticator context protects against MFA fatigue high Quick fix CIS 5.2.3.1
What it checks
Checks that Microsoft Authenticator prompts show the requesting application and the sign-in location. Technically: the Authenticator method's displayAppInformationRequiredState and displayLocationInformationRequiredState feature settings are both enabled; one alone scores partial. Orbit assesses this check only while Authenticator is enabled.
Why it matters
MFA-fatigue attacks bombard a user with push prompts until one is approved. Number matching (now enforced by Microsoft) stops blind approval. The app name and location give the user something to judge a prompt by. A request from an unfamiliar place, for an app the user isn't opening, then looks like the attack it is.
What Orbit reads
Orbit reads the MicrosoftAuthenticator configuration from GET /policies/authenticationMethodsPolicy and checks both context feature settings. Pass when both are enabled; partial with one; failure with neither.
How to fix it
Microsoft Entra admin centre → Protection → Authentication methods → Policies → Microsoft Authenticator → Configure → enable application name and geographic location. Open the admin centre.
Users & Groups
Global Administrators kept to a minimum critical Moderate CIS 1.1.3 CE · User access control
What it checks
Checks that the number of all-powerful admin accounts is small but not one. Technically: between two and four users hold the Global Administrator role.
Why it matters
Every Global Administrator is one phished credential away from a full-tenant compromise. With fewer than two, a single lost credential locks the organisation out of its own tenant.
What Orbit reads
Orbit reads Global Administrator membership via GET /directoryRoles and its members endpoint, counting user accounts only. Pass at 2–4; partial outside that range (too few or too many).
How to fix it
Microsoft Entra admin centre → Identity → Roles & administrators → Global Administrator → move day-to-day admins to scoped roles (and Privileged Identity Management where licensed). Open the admin centre.
Privileged accounts are cloud-only high Project CIS 1.1.1
What it checks
Checks that admin accounts aren't synced in from on-premises Active Directory. Technically: no member of the ten highest-privilege directory roles has onPremisesSyncEnabled.
Why it matters
If an admin account is synced, an on-premises AD compromise escalates directly into Microsoft 365 admin control. An AD compromise is the most common enterprise breach.
What Orbit reads
Orbit reads members of ten privileged roles (Global, Security, User, Application, Exchange, SharePoint admins and others) from GET /directoryRoles/{id}/members and flags any with onPremisesSyncEnabled. Pass when none; partial otherwise.
How to fix it
Create cloud-only accounts for admin duties (Microsoft Entra admin centre → Identity → Users), assign the roles to those, and remove roles from synced accounts. Open the admin centre.
No service principals in privileged roles high Moderate CE · User access control
What it checks
Checks that no application (service principal) holds a privileged directory role. Technically: no member of the privileged role set is a service principal object.
Why it matters
An app in a privileged role is a standing, non-interactive path to tenant control. No MFA, sign-in risk evaluation or PIM activation protects it. Anyone who compromises the app's credential holds the role, from anywhere, at any time.
What Orbit reads
Orbit reads GET /directoryRoles/{id}/members for the privileged role set and flags members whose @odata.type is servicePrincipal. Pass when none; failure otherwise, listing each app and its roles.
How to fix it
Microsoft Entra admin centre → Identity → Roles & administrators → the flagged role → remove the service principal. Then grant the workload the narrowest Graph application permissions that cover its job. Open the admin centre.
Privileged roles use PIM eligibility high Project CE · User access control
What it checks
Checks that privileged directory roles are held through PIM eligibility rather than standing assignments. Technically: eligible schedules exist for the privileged role set, and permanent active assignments don't outnumber them (a couple of permanent break-glass accounts are expected).
Why it matters
A permanent privileged assignment is open to attack every hour of every day. An eligible assignment exists only while activated. PIM logs each activation and can demand MFA, justification or approval first.
What Orbit reads
Orbit reads GET /roleManagement/directory/roleEligibilitySchedules and /roleAssignmentSchedules (RoleManagement.Read.Directory, Entra ID P2) and compares eligible against permanent (assignmentType Assigned with no expiration) across the privileged role set. Failure when nobody is eligible; partial when permanent assignments outnumber eligible ones; pass otherwise.
How to fix it
Microsoft Entra admin centre → Identity governance → Privileged Identity Management → Microsoft Entra roles → convert standing assignments to eligible, keeping only break-glass accounts permanent. Open the admin centre.
Global Admin activation requires approval medium Quick fix CE · User access control
What it checks
Checks that activating the Global Administrator role requires an approver. Technically: the PIM role-management policy for Global Administrator has Approval_EndUser_Assignment with isApprovalRequired true.
Why it matters
Approval puts a second pair of eyes on every entry into the tenant's most powerful role. A compromised eligible account can't quietly elevate itself, and every activation has an approver on record.
What Orbit reads
Orbit reads GET /policies/roleManagementPolicyAssignments for the Global Administrator role with its policy rules expanded (RoleManagement.Read.Directory) and inspects the activation approval rule. Pass when approval is required; partial otherwise.
How to fix it
Microsoft Entra admin centre → Identity governance → Privileged Identity Management → Microsoft Entra roles → Settings → Global Administrator → Edit → require approval to activate, and name approvers. Open the admin centre.
No active PIM security alerts high Moderate
What it checks
Checks that PIM's built-in security alerts are clear. Technically: no alert scoped to directory roles is active with a non-zero incident count.
Why it matters
PIM continuously watches for the classic privileged-access mistakes: too many Global Administrators, roles assigned outside PIM, eligible assignments that nobody activates. An unresolved alert is a finding that Microsoft has already given you.
What Orbit reads
Orbit reads GET /identityGovernance/roleManagementAlerts/alerts (beta; RoleManagementAlert.Read.Directory) filtered to directory-role scope. Pass when no active alerts; partial otherwise, listing each alert and how many principals it affects.
How to fix it
Microsoft Entra admin centre → Identity governance → Privileged Identity Management → Microsoft Entra roles → Alerts → remediate or dismiss each active alert. Open the admin centre.
Access reviews are in use medium Moderate CE · User access control
What it checks
Checks that at least one access review series is configured. Technically: GET /identityGovernance/accessReviews/definitions returns one or more definitions.
Why it matters
Access builds up. Roles, group memberships and guest accounts granted for a project outlive it unless someone confirms them again at intervals. Access reviews make that check routine instead of a one-off audit.
What Orbit reads
Orbit reads the access review definitions (AccessReview.Read.All, Entra ID P2). Pass when any series exists; partial when none.
How to fix it
Microsoft Entra admin centre → Identity governance → Access reviews → create reviews for privileged roles and guest access, with auto-apply on completion. Open the admin centre.
Admin accounts have no mailbox medium Project CIS 1.1.4 CE · User access control
What it checks
Checks that admin accounts aren't also everyday mailbox accounts. Technically: no directory-role holder has an enabled Exchange assignedPlan.
Why it matters
A mailbox lets attackers phish an admin on their most privileged account. One convincing email to that address is a tenant-level incident, not a user-level one.
What Orbit reads
Orbit cross-references role holders from GET /directoryRoles members against user assignedPlans from GET /users, flagging admins with an enabled Exchange plan. Pass when none; partial otherwise.
How to fix it
Separate the duties. Use unlicensed admin accounts for administration and licensed everyday accounts for mail. Then remove roles from the accounts that have a mailbox (Microsoft Entra admin centre → Identity → Roles & administrators). Open the admin centre.
Administrators registered for MFA critical Quick fix CIS 5.2.2.1 CE · User access control
What it checks
Checks that every admin has actually set up MFA. Technically: no user flagged isAdmin in the MFA registration report has isMfaRegistered false.
Why it matters
An MFA policy can only challenge methods that exist; an admin who never registered is protected by their password alone regardless of policy.
What Orbit reads
Orbit reads GET /reports/authenticationMethods/userRegistrationDetails and flags admins not registered for MFA. Any unregistered admin fails the check outright (no partial tier).
How to fix it
Have each flagged admin register at aka.ms/mfasetup; enforce via the registration campaign and Conditional Access. Open the admin centre.
Administrators have a phishing-resistant method high Moderate CIS 5.2.2.5 CE · User access control
What it checks
Checks that every admin has a sign-in method that can't be phished. Technically: every user flagged isAdmin in the MFA registration report has a FIDO2 security key, a device-bound passkey, Windows Hello for Business, the macOS platform credential or a certificate registered.
Why it matters
Push notifications and one-time codes can be relayed by a fake sign-in page. A Conditional Access policy that requires phishing-resistant MFA for admins only works if each admin has registered such a method.
What Orbit reads
Orbit reads GET /reports/authenticationMethods/userRegistrationDetails and checks each admin's methodsRegistered list. Every admin with a device-bound method is a pass. At least one admin with a phishing-resistant method, including a synced passkey, is a partial. No admin with one is a failure. Authenticator phone sign-in doesn't count.
How to fix it
Enable passkeys (FIDO2) in the Microsoft Entra admin centre → Entra ID → Authentication methods → Policies, then have each flagged admin register a security key or device-bound passkey at aka.ms/mysecurityinfo. Open the admin centre.
No dormant admin accounts (90+ days) high Quick fix CE · User access control
What it checks
Checks for admin accounts nobody has signed into for three months. Technically: no enabled directory-role holder's last sign-in is older than 90 days.
Why it matters
A dormant admin account is standing privilege that no user watches. It is the ideal account to take over quietly, because nobody notices activity on it.
What Orbit reads
Orbit cross-references role holders against signInActivity from GET /users (requires Entra ID P1). It flags enabled admins with no sign-in in 90 days, or with no sign-in ever recorded. Pass when none; partial otherwise.
How to fix it
Microsoft Entra admin centre → Identity → Roles & administrators → remove roles from (or disable) the dormant accounts. Open the admin centre.
Accounts with other admin roles low Moderate
What it checks
Surfaces accounts holding admin roles outside the ten highest-privilege ones, for review. Technically: users holding any other directory role (Directory Readers excepted).
Why it matters
Mid-tier roles such as Helpdesk, Intune and Teams admin build up over time, and people rarely review them. Each one increases the damage a phished account can do.
What Orbit reads
Orbit reads all role memberships from GET /directoryRoles and lists holders of the other admin roles (Directory Readers excepted). Any holder scores partial. This is a prompt to review, not a fault.
How to fix it
Microsoft Entra admin centre → Identity → Roles & administrators → review each listed assignment and remove those no longer needed. Open the admin centre.
All users registered for MFA critical Moderate CIS 5.2.3.4 CE · User access control
What it checks
Checks that every member account has MFA methods registered. Technically: no member in the MFA registration report has isMfaRegistered false.
Why it matters
Password-spray attacks find unregistered accounts first. If registration then happens during an active compromise, the attacker is the one who registers the MFA method.
What Orbit reads
Orbit reads GET /reports/authenticationMethods/userRegistrationDetails and counts members not registered. Pass when none; partial while at least 80% are registered; failure beyond that.
How to fix it
Run the Authenticator registration campaign (Microsoft Entra admin centre → Protection → Authentication methods). Then follow up the remaining users from the list in the report. Open the admin centre.
Recent sign-ins used MFA high Moderate CE · User access control
What it checks
Checks that MFA is actually being exercised, not just configured. Technically: no recently signed-in user authenticated with only a single factor.
Why it matters
Policy gaps show up here first. A user who signs in without MFA proves that a scope, an exclusion or a legacy path lets them through, whatever the policy intends.
What Orbit reads
Orbit samples the last 30 days of successful sign-ins (GET /auditLogs/signIns, most recent 1,000) and flags users whose sign-ins were single-factor. Pass when none; partial while at least 80% used MFA; failure beyond that. This is a sample, not a full audit. Busy tenants have more sign-ins than the sample holds.
How to fix it
Microsoft Entra admin centre → Identity → Monitoring & health → Sign-in logs → trace each flagged user's sign-in to find the policy gap that admitted it. Open the admin centre.
Recent sign-ins covered by Conditional Access high Moderate
What it checks
Checks that Conditional Access is actually evaluating sign-ins. Technically: no recently signed-in user's sign-ins show conditionalAccessStatus notApplied.
Why it matters
If no policy applied to a sign-in, it passed through all of the tenant's policies untouched. That shows a gap in coverage, not a healthy default.
What Orbit reads
Orbit samples the last 30 days of successful sign-ins (GET /auditLogs/signIns, most recent 1,000) and flags users whose sign-ins had no Conditional Access policy applied. Pass when none; partial while at least 80% were covered; failure beyond that. This is also a sample, not a full audit, as in the "Recent sign-ins used MFA" check.
How to fix it
Microsoft Entra admin centre → Protection → Conditional Access → review policy scoping until baseline policies apply to all users and apps. Open the admin centre.
No recent sign-ins over legacy protocols critical Moderate
What it checks
Checks whether legacy authentication is still being used, not just whether a policy forbids it. Technically: no successful sign-in in the recent sample used a client app other than a browser or a modern desktop/mobile client.
Why it matters
Legacy protocols can't show an MFA prompt, so a single credential is enough. If the block policy is report-only, or an exclusion group escapes it, the Conditional Access check still passes while these sign-ins keep succeeding.
What Orbit reads
Orbit reads the recent sign-in sample (GET /auditLogs/signIns, most recent 1,000 within 30 days). It counts successful sign-ins whose clientAppUsed is not Browser or "Mobile Apps and Desktop clients". IMAP4, POP3, SMTP, Exchange Web Services, Exchange ActiveSync, MAPI and "Other clients" all count as legacy. The score is proportional: a single user with a legacy sign-in is partial, and more than a fifth of recent users is failure. Orbit skips the check, and does not report a pass, when the sample carries no clientAppUsed. The check samples recent activity and does not audit every sign-in. It can show a live problem, but it can't prove there is none.
How to fix it
Microsoft Entra admin centre → Protection → Conditional Access → confirm the block-legacy-authentication policy is enabled (not report-only) and review its exclusions. Legacy protocols also need turning off per mailbox in Exchange Online; the policy alone doesn't disable them. Open the admin centre.
No directory sync errors medium Moderate
What it checks
Checks that hybrid accounts are syncing cleanly from on-premises. Technically: no user with onPremisesSyncEnabled has entries in onPremisesProvisioningErrors.
Why it matters
A sync error means the cloud directory and the on-premises directory have silently diverged. Every other check then reads a stale picture of that account. A disable, a group removal or a licence change may never have arrived.
What Orbit reads
Orbit reads onPremisesProvisioningErrors from GET /users and counts synced accounts carrying at least one error, showing the error categories. The score is proportional to the number of synced accounts. Cloud-only tenants have no synced users, so Orbit leaves the check out instead of showing an empty pass.
How to fix it
Resolve the conflict on-premises (usually a duplicate proxy address or UPN), then force a sync cycle with Start-ADSyncSyncCycle -PolicyType Delta. Microsoft Entra admin centre → Identity → Hybrid management → Entra Connect shows the same errors with their affected attributes. Open the admin centre.
No inactive user accounts (90+ days) medium Moderate CE · User access control
What it checks
Checks for enabled accounts nobody has signed into for three months. Technically: no enabled member account's last sign-in is older than 90 days.
Why it matters
Inactive enabled accounts are usually incomplete leaver processes: credentials that still work, often still licensed, with nobody watching for their misuse.
What Orbit reads
Orbit reads signInActivity per user from GET /users (requires Entra ID P1) and flags enabled members inactive for 90+ days or never signed in. Pass when none; partial while at least 80% are active; failure beyond that.
How to fix it
Microsoft Entra admin centre → Identity → Users → disable and then remove the flagged accounts per your leaver process. Open the admin centre.
No empty security or Microsoft 365 groups low Quick fix
What it checks
Checks for groups with no members at all. Technically: no security or Microsoft 365 group has an empty member list.
Why it matters
Empty groups stay in permission assignments and app grants. Anyone later added to one silently gets whatever access the group still has.
What Orbit reads
Orbit reads GET /groups with members expanded and flags empty security and Microsoft 365 groups (distribution lists excluded). Pass when none; partial otherwise.
How to fix it
Microsoft Entra admin centre → Identity → Groups → delete the empty groups after confirming nothing references them. Open the admin centre.
All groups have an owner low Quick fix
What it checks
Checks that every group has somebody accountable for it. Technically: no group's owners list is empty.
Why it matters
Ownerless groups have nobody to answer access reviews or membership requests. Reviews and requests for these groups go nowhere.
What Orbit reads
Orbit reads GET /groups with owners expanded and flags ownerless groups. Pass when none; partial otherwise.
How to fix it
Microsoft Entra admin centre → Identity → Groups → assign owners to each flagged group. Open the admin centre.
Guests & External Identities
Guest invitations are restricted medium Quick fix CIS 5.1.6.3
What it checks
Checks who is allowed to invite external users into the directory. Technically: the authorization policy's allowInvitesFrom is none or adminsAndGuestInviters.
Why it matters
When everyone can invite, including existing guests, external accounts join the directory with no approval step. Guest sprawl is the default outcome.
What Orbit reads
Orbit reads allowInvitesFrom from GET /policies/authorizationPolicy. Pass when only admins and guest inviters can invite, or nobody can; partial when members can also invite; failure when everyone can.
How to fix it
Microsoft Entra admin centre → Identity → External Identities → External collaboration settings → Guest invite settings. Open the admin centre.
Guest directory access is restricted medium Quick fix CIS 5.1.6.2
What it checks
Checks how much of the directory external guests can read. Technically: the authorization policy's guestUserRoleId is the Restricted role.
Why it matters
With member-equivalent access, any guest can list all your users and your group structure. That gives every invited outsider the research they need for phishing.
What Orbit reads
Orbit reads guestUserRoleId from GET /policies/authorizationPolicy. Pass with the Restricted role; partial with Microsoft's default Limited role; failure with member-equivalent access.
How to fix it
Microsoft Entra admin centre → Identity → External Identities → External collaboration settings → Guest user access → most restricted. Open the admin centre.
Email-verified users can't self-join medium Quick fix
What it checks
Checks that outsiders can't join the tenant by verifying an email address. Technically: the authorization policy's allowEmailVerifiedUsersToJoinOrganization is false.
Why it matters
Self-service joiners become real directory members, not guests. They are outside every guest-governance control and have member-level directory access. Their accounts are created without an invitation and without an admin's knowledge.
What Orbit reads
Orbit reads GET /policies/authorizationPolicy and checks allowEmailVerifiedUsersToJoinOrganization. Pass when false; partial when true. Orbit scores the check only when Graph reports the field.
How to fix it
Set the authorization policy's allowEmailVerifiedUsersToJoinOrganization to false via Microsoft Graph or Microsoft Graph PowerShell (Update-MgPolicyAuthorizationPolicy). Open the admin centre.
Cross-tenant access defaults reviewed medium Moderate
What it checks
Checks that someone has deliberately configured the B2B cross-tenant access defaults. Technically: the default cross-tenant access configuration's isServiceDefault is false.
Why it matters
The defaults decide what users from every other Entra tenant can do in yours, and what your users can do in theirs. Microsoft ships them wide open. A tenant still on service defaults has made no decision about inbound B2B collaboration, MFA trust or device trust. Guests' MFA claims are re-challenged and no tenant is blocked.
What Orbit reads
Orbit reads GET /policies/crossTenantAccessPolicy/default. Pass when isServiceDefault is false (someone configured the defaults); partial when true.
How to fix it
Microsoft Entra admin centre → Identity → External Identities → Cross-tenant access settings → review the default inbound and outbound settings (and inbound trust) and save a deliberate configuration. Open the admin centre.
No self-service sign-up flows medium Quick fix
What it checks
Checks that no self-service sign-up user flows are live. Technically: GET /identity/b2xUserFlows returns no flows.
Why it matters
A sign-up flow lets unknown external users create their own guest accounts through an app's sign-in page. It is a standing open door that bypasses the invitation controls. Each flow should be a deliberate, reviewed decision, not a leftover experiment.
What Orbit reads
Orbit reads the external-identity user flows (IdentityUserFlow.Read.All). Pass when none exist; partial otherwise, listing each flow so it can be confirmed as intended.
How to fix it
Microsoft Entra admin centre → Identity → External Identities → User flows → delete flows that are no longer intended, and review the apps attached to those that remain. Open the admin centre.
Partner access avoids Global Administrator high Moderate CE · User access control
What it checks
Checks that no live partner (GDAP) relationship into the tenant grants Global Administrator. Technically: no active delegated admin relationship's access details include the Global Administrator role.
Why it matters
GDAP exists so that partners no longer hold standing Global Administrator in customer tenants. If a partner relationship still grants Global Administrator, a breach at the partner can become a takeover of your tenant. Least-privilege roles cover virtually every support task.
What Orbit reads
Orbit reads the delegated admin relationships from the partner's side (DelegatedAdminRelationship.Read.All in the tenant that runs Orbit) and filters them to your tenant. The two partner checks appear only when live relationships exist. Pass when no live relationship includes Global Administrator; failure otherwise.
How to fix it
Microsoft 365 admin centre → Settings → Partner relationships → review the relationship's roles with your partner and re-establish it with least-privilege roles instead of Global Administrator. Open the admin centre.
Partner relationships don't auto-extend medium Quick fix
What it checks
Checks that partner (GDAP) relationships carry a hard end date. Technically: no live delegated admin relationship has an autoExtendDuration set.
Why it matters
GDAP's time limit only works if expiry forces a renewal decision. Auto-extension turns delegated access back into standing access, because nobody ever has to justify it again.
What Orbit reads
Orbit reads the delegated admin relationships from the partner's side (DelegatedAdminRelationship.Read.All in the tenant that runs Orbit) and flags live relationships whose autoExtendDuration is set. Pass when none auto-extend; partial otherwise.
How to fix it
Microsoft 365 admin centre → Settings → Partner relationships → agree with your partner to disable auto-extend so each renewal is a deliberate approval. Open the admin centre.
No guests hold directory roles critical Quick fix CE · User access control
What it checks
Checks that no external account holds admin rights in your directory. Technically: no guest user appears in any directory role's membership.
Why it matters
An admin role on a guest account is privilege that your organisation can't monitor, with credentials it can't manage. The account's security depends on someone else's tenant.
What Orbit reads
Orbit cross-references guest users (GET /users filtered to userType Guest) against role memberships from GET /directoryRoles. Any match fails the check outright.
How to fix it
Microsoft Entra admin centre → Identity → Roles & administrators → remove the guest from the role; if the duty is real, use a member account instead. Open the admin centre.
No guests in role-assignable groups critical Quick fix CE · User access control
What it checks
Checks that no external account sits in a group that can be granted admin rights. Technically: no guest user appears in the membership of any group with isAssignableToRole set.
Why it matters
A role-assignable group can be given a directory role at any time. A guest inside one holds the same privilege as a guest who holds the role. But the guest appears as an ordinary group member, where a role review won't look.
What Orbit reads
Orbit cross-references guest users (GET /users filtered to userType Guest) against the membership of groups from GET /groups where isAssignableToRole is true. Any match fails the check outright. Orbit skips the check, and does not report a pass, when the group data was collected before Orbit read this property.
How to fix it
Microsoft Entra admin centre → Identity → Groups → All groups → open the group → Members → remove the guest; if the access is genuinely needed, grant it through a non-role-assignable group instead. Open the admin centre.
No stale guest accounts (90+ days) medium Quick fix CIS 5.3.2 CE · User access control
What it checks
Checks for guest accounts that haven't been used in three months. Technically: no enabled, accepted guest's last sign-in is older than 90 days.
Why it matters
Stale guests are finished collaborations whose access nobody revoked. Each one still has external access to whatever was shared with it.
What Orbit reads
Orbit reads guest users with signInActivity from GET /users (requires Entra ID P1 for sign-in data) and flags enabled guests inactive for 90+ days. Pass when none; partial while at least 80% of guests are current; failure beyond that.
How to fix it
Microsoft Entra admin centre → Identity → Users → filter to guests → delete stale accounts (access reviews automate this where licensed). Open the admin centre.
No pending guest invitations low Quick fix
What it checks
Checks for guest invitations that were sent but never accepted. Technically: no guest account sits in the PendingAcceptance state.
Why it matters
A pending invitation stays in an external mailbox indefinitely. Someone can redeem it long after the reason for it has passed.
What Orbit reads
Orbit reads externalUserState per guest from GET /users and flags PendingAcceptance accounts. Pass when none; partial while they're under 20% of guests; failure beyond that.
How to fix it
Microsoft Entra admin centre → Identity → Users → delete unredeemed invitations and re-invite only where still needed. Open the admin centre.
App Management
User consent for apps restricted critical Quick fix CIS 5.1.5.1
What it checks
Checks that users can't grant third-party apps access to company data by themselves. Technically: the default user role's permission-grant policies are empty (admin approval required) or limited to low-risk verified publishers.
Why it matters
Open user consent is how consent phishing works. After one convincing OAuth prompt, an attacker's app holds a durable token to the user's mail and files, and MFA doesn't stop it.
What Orbit reads
Orbit reads defaultUserRolePermissions.permissionGrantPoliciesAssigned from GET /policies/authorizationPolicy. It considers only the ManagePermissionGrantsForSelf entry. It ignores ManagePermissionGrantsForOwnedResource entries: they govern Teams resource-specific consent and remain in the collection even with user consent disabled. Pass with no self entry ("Do not allow user consent") or with the microsoft-user-default-low policy. Failure with the microsoft-user-default-legacy policy (any app). Partial with a custom consent policy, so that you review its scope.
How to fix it
Microsoft Entra admin centre → Identity → Applications → Enterprise applications → Consent and permissions → User consent settings. Open the admin centre.
User consent blocked for risky apps high Quick fix
What it checks
Checks that consent requests Microsoft classes as risky are blocked outright. Technically: the BlockUserConsentForRiskyApps consent setting is true.
Why it matters
Microsoft classes a consent request as risky when its own telemetry links the request to consent-phishing campaigns. If you allow these requests, you rely on each user's judgement at the prompt.
What Orbit reads
Orbit reads BlockUserConsentForRiskyApps from the Consent Policy Settings values in GET /groupSettings. Pass when true; partial otherwise.
How to fix it
This setting is on by default in the Consent Policy Settings directory setting. If someone has turned it off, turn it back on with Microsoft Graph PowerShell. Open the admin centre.
Group owner consent disabled medium Quick fix
What it checks
Checks that group owners can't grant apps access to their group's data. Technically: the EnableGroupSpecificConsent consent setting is false.
Why it matters
Group-owner consent is user consent with a wider blast radius: one owner's approval exposes the whole group's files and conversations to the app.
What Orbit reads
Orbit reads EnableGroupSpecificConsent from the Consent Policy Settings values in GET /groupSettings. Pass when false; partial otherwise.
How to fix it
Microsoft Entra admin centre → Identity → Applications → Enterprise applications → Consent and permissions → Group owner consent settings. Open the admin centre.
Admin consent request workflow enabled medium Quick fix CIS 5.1.5.2
What it checks
Checks that users have a governed route to request app approvals. Technically: the admin consent request policy's isEnabled is true.
Why it matters
With consent restricted and no request workflow, users work around IT. They use unmanaged personal accounts and shadow tools instead of asking for a review.
What Orbit reads
Orbit reads GET /policies/adminConsentRequestPolicy and passes when the workflow is enabled; failure otherwise.
How to fix it
Microsoft Entra admin centre → Identity → Applications → Enterprise applications → Admin consent settings → enable requests and set reviewers. Open the admin centre.
App registration restricted to admins medium Quick fix CIS 5.1.2.2
What it checks
Checks that ordinary users can't create app registrations. Technically: the default user role's allowedToCreateApps is false.
Why it matters
A user-created app registration is an unmonitored credential store: its owner can mint secrets and request permissions outside any admin's view.
What Orbit reads
Orbit reads defaultUserRolePermissions.allowedToCreateApps from GET /policies/authorizationPolicy. Pass when false; partial otherwise.
How to fix it
Microsoft Entra admin centre → Identity → Users → User settings → "Users can register applications" → No. Open the admin centre.
No expired application credentials low Moderate
What it checks
Checks for app registrations carrying expired secrets or certificates. Technically: no application credential's endDateTime is in the past.
Why it matters
Expired credentials mean either a broken integration that nobody noticed or an abandoned app that nobody owns. Both show that nobody is managing the tenant's apps.
What Orbit reads
Orbit reads passwordCredentials and keyCredentials per app from GET /applications and flags any expired. Any expired credential fails the check outright.
How to fix it
Microsoft Entra admin centre → Identity → Applications → App registrations → rotate or remove the expired credentials; delete abandoned apps. Open the admin centre.
No credentials expiring within 30 days low Moderate
What it checks
Checks for app secrets and certificates about to expire. Technically: no application credential's endDateTime falls within the next 30 days.
Why it matters
An expiring credential is a scheduled outage for the integration that uses it. A last-minute fix on expiry day often produces a rushed replacement secret with a long lifetime.
What Orbit reads
Orbit reads credential expiry dates per app from GET /applications and flags any ending within 30 days. Pass when none; partial otherwise.
How to fix it
Microsoft Entra admin centre → Identity → Applications → App registrations → Certificates & secrets → rotate ahead of expiry. Open the admin centre.
No secrets valid longer than 2 years medium Moderate CIS 5.1.5.4
What it checks
Checks that app secrets aren't issued with excessive lifetimes. Technically: no application credential spans more than 730 days from start to end.
Why it matters
A long-lived secret that leaks stays usable for years; short lifetimes bound the exposure window of any leak to months.
What Orbit reads
Orbit computes each credential's validity span from GET /applications and flags any over two years. Pass when none; partial otherwise.
How to fix it
Microsoft Entra admin centre → Identity → Applications → App registrations → replace long-lived secrets with shorter ones (or certificates) at next rotation. Open the admin centre.
All app registrations have an owner low Moderate
What it checks
Checks that every app registration has somebody accountable for it. Technically: no application's owners list is empty.
Why it matters
In practice, nobody rotates the secrets of an ownerless app. Nobody knows what breaks if a secret is revoked, so nobody ever revokes it.
What Orbit reads
Orbit reads GET /applications with owners expanded and flags ownerless registrations. Pass when none; partial otherwise.
How to fix it
Microsoft Entra admin centre → Identity → Applications → App registrations → Owners → assign at least one per app. Open the admin centre.
No apps with high-impact access to tenant data high Moderate
What it checks
Surfaces apps holding tenant-wide access to mail, files or the directory, for review. Technically: app-role grants from a set of about two dozen high-privilege permissions (Directory.ReadWrite.All, Mail.Read, Sites.FullControl.All and similar), plus tenant-wide delegated grants of comparable scope.
Why it matters
Each such grant is a standing path to organisation-wide data through the app's own credentials, and MFA doesn't protect it. If the app is compromised, the tenant's data is breached.
What Orbit reads
Orbit reads app-role assignments on the Microsoft Graph, Exchange and SharePoint service principals (GET /servicePrincipals/{id}/appRoleAssignedTo) and tenant-wide entries from GET /oauth2PermissionGrants. It matches both against its high-privilege permission set. Any holder scores partial. This is a prompt to review, because some grants are legitimate.
How to fix it
Microsoft Entra admin centre → Identity → Applications → Enterprise applications → Permissions → review each listed app and revoke grants that aren't justified. Open the admin centre.
No dormant enterprise apps medium Moderate
What it checks
Checks for third-party apps still holding access nobody has used in three months. Technically: no enabled non-Microsoft service principal's last sign-in is older than 90 days.
Why it matters
A dormant app's permissions and credentials remain live. It is like a leaver's account: access with no user.
What Orbit reads
Orbit joins enabled third-party service principals (GET /servicePrincipals) with GET /servicePrincipalSignInActivities (beta; requires Entra ID P1). It flags apps with no sign-in in 90 days, or with none recorded. Pass when none; partial otherwise. Orbit skips the check when sign-in activity is unavailable.
How to fix it
Microsoft Entra admin centre → Identity → Applications → Enterprise applications → delete or disable the dormant apps. Open the admin centre.
Third-party apps have an owner low Moderate
What it checks
Checks that someone in the organisation is accountable for each third-party integration. Technically: every enabled, externally-owned service principal has at least one owner assigned.
Why it matters
When an enterprise app has no owner, nobody can say whether the integration is still needed, still scoped correctly or still supported. The app then survives every review by default and keeps its consented access indefinitely.
What Orbit reads
Orbit reads GET /servicePrincipals expanded with owners and counts enabled, Application-type service principals owned by another tenant that have none. The tenant's own apps are covered by "All app registrations have an owner", and Orbit excludes Microsoft's first-party service principals.
How to fix it
Microsoft Entra admin centre → Identity → Applications → Enterprise applications → open the app → Owners → add the person or team responsible for the integration. Open the admin centre.
Third-party apps have verified publishers medium Moderate
What it checks
Checks that third-party apps in the tenant come from publishers Microsoft has verified. Technically: no enabled third-party service principal lacks a verifiedPublisher.
Why it matters
Unverified publishers are the norm in consent-phishing tooling; verification ties an app to a vetted Microsoft partner identity that can be held to account.
What Orbit reads
Orbit reads verifiedPublisher on enabled, external, application-type service principals from GET /servicePrincipals (Microsoft's own and your tenant's apps excluded). Pass when all are verified; partial otherwise.
How to fix it
Microsoft Entra admin centre → Identity → Applications → Enterprise applications → review each unverified app; replace or remove those without a credible publisher. Open the admin centre.
Tenant creation restricted to admins high Quick fix CIS 5.1.2.3
What it checks
Checks that ordinary users cannot create new Entra tenants. Technically: the authorization policy's default user permission allowedToCreateTenants is false. Orbit assesses this check only when Graph reports the field.
Why it matters
A tenant that a user creates looks connected to your company, and that user is its Global Administrator. It is outside every policy, log and control you run. Standard users have no business reason for this ability, and it is on by default.
What Orbit reads
Orbit reads GET /policies/authorizationPolicy and checks defaultUserRolePermissions.allowedToCreateTenants. Pass when false; failure when true.
How to fix it
Microsoft Entra admin centre → Identity → Users → User settings → Restrict non-admin users from creating tenants → Yes. Open the admin centre.
Security group creation restricted low Quick fix CIS 5.1.3.1
What it checks
Checks that ordinary users cannot create security groups. Technically: the authorization policy's default user permission allowedToCreateSecurityGroups is false. Orbit assesses this check only when Graph reports the field.
Why it matters
Security groups grant access. When anyone can create them, group sprawl follows. Groups with no owner and no review end up on resources, and nobody is accountable for the access they give.
What Orbit reads
Orbit reads GET /policies/authorizationPolicy and checks defaultUserRolePermissions.allowedToCreateSecurityGroups. Pass when false; partial when true.
How to fix it
Microsoft Entra admin centre → Identity → Groups → General → "Users can create security groups in Azure portals, API or PowerShell" → No. Open the admin centre.
App credential lifetimes enforced by policy medium Moderate
What it checks
Checks that a tenant policy prevents risky app credentials being created, rather than only reporting them afterwards. Technically: the default app-management policy is enabled with at least one active password-credential restriction (blocking new secrets or capping their lifetime).
Why it matters
The other app-credential checks only detect problems: they find the two-year secret after someone creates it. Without a policy, nothing stops the next one. With a policy, Entra refuses to create it.
What Orbit reads
Orbit reads GET /policies/defaultAppManagementPolicy. Pass when the policy is enabled with an active passwordCredentials restriction; partial when enabled with none; failure when disabled.
How to fix it
Set the tenant default app-management policy with Microsoft Graph (Update defaultAppManagementPolicy) or Microsoft Graph PowerShell. Enable passwordAddition or passwordLifetime restrictions, for example a maximum secret lifetime of one year. Open the admin centre.
No apps with a path to Global Admin high Moderate
What it checks
Checks that no application holds a permission that would let it escalate itself to Global Administrator. Technically: no service principal holds the RoleManagement.ReadWrite.Directory or AppRoleAssignment.ReadWrite.All application permissions.
Why it matters
An app with either permission can assign directory roles, or grant arbitrary app roles, including to itself. Compromising that one app is therefore a full tenant takeover. Unlike the broader high-impact review, a holder here is a definite finding.
What Orbit reads
Orbit reads each high-value resource's appRoleAssignedTo list and flags any service principal granted one of the two escalation permissions. Pass with none; failure with any.
How to fix it
Microsoft Entra admin centre → Identity → Applications → Enterprise applications → the flagged app → Permissions → remove the role-management / app-role-assignment application permission, or replace the integration with one scoped to what it actually does. Open the admin centre.
Redirect URIs are safe high Quick fix
What it checks
Checks that app registrations don't accept sign-in responses at unsafe addresses. Technically: no web, SPA or public-client redirect URI uses a wildcard or plain HTTP (localhost excepted for native-app loopback).
Why it matters
The redirect URI is where tokens are delivered. A wildcard lets an attacker receive them on any matching host. Plain HTTP exposes them on the network. Either one turns a phished click into a captured session.
What Orbit reads
Orbit reads GET /applications (web, spa and publicClient redirect URIs) and flags wildcard or non-HTTPS entries. Pass with none; partial with any, listing each app and URI.
How to fix it
Microsoft Entra admin centre → Identity → Applications → App registrations → the flagged app → Authentication → replace wildcard or HTTP redirect URIs with exact HTTPS addresses. Open the admin centre.
No redirect URIs on dead domains medium Quick fix
What it checks
Checks that no redirect URI points at a DNS name that no longer exists. Technically: every redirect-URI hostname still resolves in public DNS (Orbit flags only a hard NXDOMAIN).
Why it matters
A redirect URI on a lapsed domain is an open takeover risk. Whoever registers the dead domain receives that app's sign-in tokens, with no phishing needed. These URIs usually come from retired vendors or rebrands that nobody cleaned up.
What Orbit reads
Orbit resolves each unique redirect-URI hostname once per refresh (loopback, IP literals and wildcards excluded). The check is deliberately cautious. Orbit never flags a name that exists without address records, or a name that DNS couldn't answer for. Pass when every domain exists; partial otherwise, with each app and URI listed for review. Before you act, verify that the domain really left your control.
How to fix it
Microsoft Entra admin centre → Identity → Applications → App registrations → the flagged app → Authentication → remove the dead redirect URI (or re-register the domain if it should still be yours). Open the admin centre.
Multi-tenant apps have the instance lock medium Quick fix
What it checks
Checks that apps other tenants can install protect their service-principal instances from tampering. Technically: every app registration whose signInAudience accepts other organisations has the app instance property lock enabled.
Why it matters
When another tenant installs your multi-tenant app, that tenant's admins can edit the service principal, including its credentials. The instance lock prevents this. Without the lock, an instance in a compromised customer tenant becomes a way to inject credentials back into the app.
What Orbit reads
Orbit reads GET /applications and, for registrations with a multi-tenant signInAudience, checks servicePrincipalLockConfiguration.isEnabled. Pass when all are locked; partial otherwise. Tenants with no multi-tenant registrations don't see this check.
How to fix it
Microsoft Entra admin centre → Identity → Applications → App registrations → the flagged app → Authentication → App instance property lock → Configure → enable for all properties. Open the admin centre.
App owners registered for MFA medium Quick fix
What it checks
Checks that every app registration owner has registered for multifactor authentication. Technically: each owner listed on an app registration appears in the authentication-methods registration report as MFA-registered.
Why it matters
An app's owners can rotate its credentials and reconfigure it, so each owner is a path to everything the app can reach. An owner protected by only a password hands that whole permission set to one phished credential.
What Orbit reads
Orbit joins GET /applications?$expand=owners against GET /reports/authenticationMethods/userRegistrationDetails by user id and flags owners with isMfaRegistered false. Pass when every known owner is registered; partial otherwise.
How to fix it
Have each flagged owner register at aka.ms/mfasetup, or transfer ownership to accounts that meet the admin MFA baseline. Open the admin centre.
Intune
Device Management
Device compliance policies configured high Moderate CIS 4.1 CE · Secure configuration
What it checks
Checks that rules exist defining what a healthy, trustworthy device looks like. Technically: at least one Intune device compliance policy exists in the tenant.
Why it matters
Without compliance policies, every enrolled device is implicitly trusted. An out-of-date, unencrypted or unhealthy device gets the same access as a hardened one. Conditional Access can't require compliant devices, because nothing defines compliance.
What Orbit reads
Orbit reads GET /deviceManagement/deviceCompliancePolicies and passes if at least one policy exists. Orbit checks only that a policy exists. It doesn't evaluate assignment or how strict each setting is.
How to fix it
Microsoft Intune admin centre → Devices → Compliance → Create policy, then assign it to all device groups. Open the admin centre.
All devices compliant with compliance policies high Moderate CE · Secure configuration
What it checks
Checks that managed devices actually meet the compliance rules set for them. Technically: no managed device reports a complianceState of noncompliant, error, conflict or in-grace-period.
Why it matters
A non-compliant device has already failed the tenant's own definition of trustworthy. Common causes are missing encryption, an outdated OS or a lapsed check-in. The device may still hold cached corporate data and active sessions.
What Orbit reads
Orbit reads complianceState per device from GET /deviceManagement/managedDevices. Pass when no device is in a failing state; partial while failing devices are a minority (up to half); failure beyond that. Devices in grace period count as failing.
How to fix it
Microsoft Intune admin centre → Devices → Compliance → Monitor → Noncompliant devices; fix per-device causes or adjust the policy if a rule is wrong. Open the admin centre.
Configuration profiles deploying without errors medium Moderate
What it checks
Checks that the settings Intune pushes to devices are arriving cleanly. Technically: the tenant-wide device configuration state summary reports zero devices in error or conflict.
Why it matters
A profile in error or conflict means the intended configuration is not applied on those devices. Often it is a security setting. The console still shows the profile as deployed.
What Orbit reads
Orbit reads errorDeviceCount and conflictDeviceCount from GET /deviceManagement/deviceConfigurationDeviceStateSummaries. Pass when both are zero; otherwise partial. This is a tenant-wide total, so Orbit can't identify which profile is failing.
How to fix it
Microsoft Intune admin centre → Devices → Configuration → open each profile's Device status to find the failing devices, and resolve conflicts by removing duplicate settings across profiles. Open the admin centre.
All devices syncing with Intune medium Moderate
What it checks
Checks that managed devices are still checking in. Technically: every managed device has a lastSyncDateTime within the last 30 days.
Why it matters
A device that stops syncing stops receiving policy, compliance evaluation and remote actions, including wipe and lock. It still holds corporate data and credentials.
What Orbit reads
Orbit reads lastSyncDateTime per device from GET /deviceManagement/managedDevices and flags devices with no sync in over 30 days (or none recorded). Pass when none are inactive; partial while inactive devices are a minority; failure beyond half.
How to fix it
Microsoft Intune admin centre → Devices → All devices → filter by last check-in; retire or wipe devices that are genuinely gone, and troubleshoot the rest. Open the admin centre.
All devices encrypted critical Moderate
What it checks
Checks that company devices scramble their storage so a lost or stolen device doesn't give up its data. Technically: no managed device reports isEncrypted as false.
Why it matters
An unencrypted device that is lost or stolen exposes every file, cached mailbox and saved credential on it. Anyone who removes the disk can read them without a password.
What Orbit reads
Orbit reads isEncrypted per device from GET /deviceManagement/managedDevices and flags devices explicitly reporting false. Pass when none do; partial while they're a minority; failure beyond half. Orbit doesn't flag devices that don't report the property. With no enrolled devices, the check passes and says why ("No devices are enrolled in Intune — nothing to check"). It doesn't claim that your devices are healthy.
How to fix it
Microsoft Intune admin centre → Devices → All devices to find the unencrypted devices; enforce BitLocker/FileVault via Endpoint security → Disk encryption. Open the admin centre.
No jailbroken or rooted devices critical Quick fix CE · Secure configuration
What it checks
Checks that no phone or tablet with broken security controls can reach company data. Technically: no managed device reports jailBroken as true.
Why it matters
A jailbroken or rooted device has its platform protections disabled. Malware can read app data, keychains and tokens, and can bypass every app-level control that Intune applies.
What Orbit reads
Orbit reads the jailBroken property per device from GET /deviceManagement/managedDevices. A single affected device fails the check outright (failure, with no partial result).
How to fix it
Microsoft Intune admin centre → Devices → All devices → retire the affected device and block it via compliance policy (Device health → Jailbroken devices → Block). Open the admin centre.
No devices with pending actions low Quick fix
What it checks
Checks that remote commands sent to devices have actually completed. Technically: no managed device has an entry in deviceActionResults still in the pending or active state.
Why it matters
If a remote wipe or retire is stuck, the action you rely on to protect a lost device hasn't happened. The data is still on the device.
What Orbit reads
Orbit reads deviceActionResults per device from GET /deviceManagement/managedDevices and flags any action still pending or active. Pass when none are; otherwise partial. A freshly issued action looks the same as a stuck one, so expect transient flags just after issuing commands.
How to fix it
Microsoft Intune admin centre → Devices → All devices → open the device → Device actions status; reissue actions that have stalled. Open the admin centre.
Mobile App Protection
iOS app protection policy configured high Moderate
What it checks
Checks that company data inside apps on iPhones and iPads is protected even on personal devices. Technically: at least one iOS app protection (MAM) policy exists.
Why it matters
Without an app protection policy, nothing restricts corporate data in Outlook, Teams and Office on an unmanaged iOS device. Users can copy it, back it up or move it into personal apps. You can't selectively wipe it when someone leaves.
What Orbit reads
Orbit reads GET /deviceAppManagement/iosManagedAppProtections and passes if at least one policy exists.
How to fix it
Microsoft Intune admin centre → Apps → App protection policies → Create policy → iOS/iPadOS, targeting the core Microsoft 365 apps. Open the admin centre.
Android app protection policy configured high Moderate
What it checks
Checks that company data inside apps on Android phones is protected even on personal devices. Technically: at least one Android app protection (MAM) policy exists.
Why it matters
Without an app protection policy, corporate data in mobile apps on unmanaged Android devices can flow freely into personal apps and cloud backups. You can't selectively wipe it.
What Orbit reads
Orbit reads GET /deviceAppManagement/androidManagedAppProtections and passes if at least one policy exists.
How to fix it
Microsoft Intune admin centre → Apps → App protection policies → Create policy → Android, targeting the core Microsoft 365 apps. Open the admin centre.
App access PIN required medium Quick fix
What it checks
Checks that opening a work app on a mobile requires a PIN. Technically: every app protection policy sets pinRequired to true.
Why it matters
Without an app PIN, anyone who holds an unlocked phone can open corporate mail and files directly, whether the phone is borrowed, lost or stolen. On devices with weak or shared unlock codes, the app PIN is the only barrier.
What Orbit reads
Orbit reads pinRequired on every iOS and Android app protection policy. Pass only when all policies require a PIN; otherwise partial, listing the policies that don't.
How to fix it
Microsoft Intune admin centre → Apps → App protection policies → edit each policy → Access requirements → PIN for access: Require. Open the admin centre.
Data transfer limited to managed apps high Quick fix
What it checks
Checks that work data can't be sent from work apps into personal apps on mobiles. Technically: every app protection policy restricts allowedOutboundDataTransferDestinations to managedApps.
Why it matters
If outbound transfer is open, a user can share a corporate document from Outlook into any personal app, such as WhatsApp, Gmail or a notes app. The data is then outside every control the tenant has.
What Orbit reads
Orbit reads allowedOutboundDataTransferDestinations on every app protection policy. Pass only when all policies restrict transfer to managed apps; otherwise partial.
How to fix it
Microsoft Intune admin centre → Apps → App protection policies → edit each policy → Data protection → Send org data to other apps: Policy managed apps. Open the admin centre.
App data backup blocked medium Quick fix
What it checks
Checks that work data isn't silently copied into personal cloud backups of a phone. Technically: every app protection policy sets disableAppBackup to true.
Why it matters
iCloud and Android backups of app data put corporate content in a personal consumer cloud account. There it is outside retention, wipe and legal-hold controls, and it stays there after the employee leaves.
What Orbit reads
Orbit reads disableAppBackup on every app protection policy. Pass only when all policies block backup; otherwise partial. Orbit doesn't count a policy that doesn't report the property as a shortfall, because the MAM collection endpoints don't always return every hardening setting. The note says how many policies didn't report it.
How to fix it
Microsoft Intune admin centre → Apps → App protection policies → edit each policy → Data protection → Back up org data: Block. Open the admin centre.
App data encrypted high Quick fix
What it checks
Checks that work data stored inside mobile apps is encrypted by the app itself. Technically: every app protection policy sets encryptAppData to true.
Why it matters
Without app-level encryption, corporate data cached by mobile apps relies solely on device encryption. On unmanaged personal devices, device encryption can be missing or bypassed.
What Orbit reads
Orbit reads encryptAppData on every app protection policy. Pass only when all policies encrypt; otherwise partial. Orbit doesn't count policies that don't report the property as a shortfall.
How to fix it
Microsoft Intune admin centre → Apps → App protection policies → edit each policy → Data protection → Encrypt org data: Require. Open the admin centre.
Security Baselines
Windows 10 and later baseline deployed high Moderate CE · Secure configuration
What it checks
Checks that Windows devices get Microsoft's recommended security settings as a bundle. Technically: an Intune security-baseline profile for Windows 10 and later exists and is assigned.
Why it matters
Without the baseline, hundreds of hardening settings stay at permissive defaults unless someone configures each one by hand. Examples are SmartScreen, credential protection, and script and macro controls.
What Orbit reads
Orbit reads Intune's template and intent lists (GET /deviceManagement/templates and /deviceManagement/intents, beta) and looks for a deployed profile whose baseline template name contains "Windows 10". Failure when none exists; partial when deployed but assigned to no group; pass when assigned. Matching is by template name, so renamed templates can misreport.
How to fix it
Microsoft Intune admin centre → Endpoint security → Security baselines → Windows 10 and later → Create profile, and assign it. Open the admin centre.
Microsoft 365 Apps baseline deployed medium Moderate CE · Secure configuration
What it checks
Checks that Office apps on Windows get Microsoft's recommended hardening. Technically: the Microsoft 365 Apps for Enterprise security baseline is deployed and assigned.
Why it matters
Office macros and add-ins are a primary malware entry route; without the baseline, macro blocking and Protected View settings depend on per-machine defaults.
What Orbit reads
Orbit reads Intune's template and intent lists (GET /deviceManagement/templates and /deviceManagement/intents, beta) and matches profiles whose template name contains "365 Apps". Failure when no profile exists; partial when it is deployed but unassigned; pass when assigned.
How to fix it
Microsoft Intune admin centre → Endpoint security → Security baselines → Microsoft 365 Apps for Enterprise → Create profile, and assign it. Open the admin centre.
Microsoft Edge baseline deployed medium Moderate CE · Secure configuration
What it checks
Checks that the Edge browser gets Microsoft's recommended security settings. Technically: the Microsoft Edge security baseline is deployed and assigned.
Why it matters
The browser is where credential phishing and drive-by downloads happen; without the baseline, SmartScreen and site-isolation protections vary per machine.
What Orbit reads
Orbit reads Intune's template and intent lists (GET /deviceManagement/templates and /deviceManagement/intents, beta) and matches profiles whose template name contains "Edge". Failure when no profile exists; partial when it is deployed but unassigned; pass when assigned.
How to fix it
Microsoft Intune admin centre → Endpoint security → Security baselines → Microsoft Edge → Create profile, and assign it. Open the admin centre.
Microsoft Defender for Endpoint baseline deployed high Moderate CE · Secure configuration
What it checks
Checks that Microsoft's recommended settings for its endpoint detection product are applied. Technically: the Defender for Endpoint security baseline is deployed and assigned.
Why it matters
Defender for Endpoint with weakened settings, such as reduced cloud protection or disabled tamper protection, detects less. The attacker it is meant to catch can also switch it off.
What Orbit reads
Orbit reads Intune's template and intent lists (GET /deviceManagement/templates and /deviceManagement/intents, beta) and matches profiles whose template name contains "Defender for Endpoint". Failure when no profile exists; partial when it is deployed but unassigned; pass when assigned. Requires Defender for Endpoint licensing to be meaningful.
How to fix it
Microsoft Intune admin centre → Endpoint security → Security baselines → Microsoft Defender for Endpoint → Create profile, and assign it. Open the admin centre.
Windows 365 baseline deployed low Moderate CE · Secure configuration
What it checks
Checks that Cloud PCs get Microsoft's recommended security settings. Technically: the Windows 365 security baseline is deployed and assigned.
Why it matters
Cloud PCs are full Windows desktops reachable from anywhere; left at defaults they carry the same hardening gaps as an unmanaged laptop.
What Orbit reads
Orbit reads Intune's template and intent lists (GET /deviceManagement/templates and /deviceManagement/intents, beta) and matches profiles whose template name contains "Windows 365". Failure when no profile exists; partial when it is deployed but unassigned; pass when assigned. The check is relevant only to tenants that use Windows 365.
How to fix it
Microsoft Intune admin centre → Endpoint security → Security baselines → Windows 365 → Create profile, and assign it. Open the admin centre.
Endpoint Security
Antivirus policy configured critical Moderate CE · Malware protection
What it checks
Checks that devices have centrally managed antivirus protection. Technically: at least one Intune endpoint-security policy in the Antivirus category exists.
Why it matters
With unmanaged antivirus, nothing guarantees that real-time protection is on, that exclusions are sensible or that tamper protection is enforced. Users or malware can simply turn it off.
What Orbit reads
Orbit reads both endpoint-security deployment models (beta). The first is the legacy intents (GET /deviceManagement/intents with /deviceManagement/templates, matched on template name). The second is the settings catalog (GET /deviceManagement/configurationPolicies, matched on templateReference.templateFamily; here endpointSecurityAntivirus). The check passes if either has a policy. Orbit checks only that a policy exists, not that it is assigned.
How to fix it
Microsoft Intune admin centre → Endpoint security → Antivirus → Create policy. Open the admin centre.
Disk encryption policy configured critical Moderate
What it checks
Checks that device disk encryption is enforced centrally rather than left to chance. Technically: at least one endpoint-security Disk encryption (BitLocker/FileVault) policy exists.
Why it matters
Without an enforcement policy, encryption depends on per-device defaults; one unencrypted lost laptop is a reportable data breach.
What Orbit reads
Orbit reads both endpoint-security deployment models (beta): the legacy intents (GET /deviceManagement/intents with /deviceManagement/templates) and the settings catalog (GET /deviceManagement/configurationPolicies). It matches the Disk encryption category by BitLocker/FileVault template names, or by the endpointSecurityDiskEncryption template family. Pass if any policy exists; failure otherwise.
How to fix it
Microsoft Intune admin centre → Endpoint security → Disk encryption → Create policy. Open the admin centre.
Firewall policy configured high Moderate CE · Firewalls
What it checks
Checks that the built-in firewall on devices is managed and can't be quietly disabled. Technically: at least one endpoint-security Firewall policy exists.
Why it matters
With no firewall policy, a user or installer can disable the host firewall and nothing turns it back on. The device is then open on hostile networks.
What Orbit reads
Orbit reads both endpoint-security deployment models (beta): the legacy intents (GET /deviceManagement/intents with /deviceManagement/templates) and the settings catalog (GET /deviceManagement/configurationPolicies). It matches the Firewall category by template name, or by the endpointSecurityFirewall / …FirewallRules families. Pass if any policy exists; failure otherwise.
How to fix it
Microsoft Intune admin centre → Endpoint security → Firewall → Create policy. Open the admin centre.
Endpoint detection & response policy configured critical Moderate
What it checks
Checks that devices are enrolled into endpoint detection and response tooling. Technically: at least one endpoint-security EDR policy exists.
Why it matters
Without EDR onboarding, a compromised device generates no alert and no forensic timeline. You find out about an intrusion only from the damage it causes.
What Orbit reads
Orbit reads both endpoint-security deployment models (beta): the legacy intents (GET /deviceManagement/intents with /deviceManagement/templates) and the settings catalog (GET /deviceManagement/configurationPolicies). It matches the EDR category by template name, or by the endpointSecurityEndpointDetectionAndResponse family. Pass if any policy exists; failure otherwise. Needs Defender for Endpoint licensing to onboard devices.
How to fix it
Microsoft Intune admin centre → Endpoint security → Endpoint detection and response → Create policy. Open the admin centre.
Attack surface reduction policy configured high Moderate
What it checks
Checks that common malware entry routes on Windows are blocked by policy. Technically: at least one endpoint-security Attack surface reduction policy exists.
Why it matters
ASR rules block the standard ways attackers first get in: Office spawning child processes, script-borne downloads, credential theft from LSASS. Without the rules, these routes are open on every device.
What Orbit reads
Orbit reads both endpoint-security deployment models (beta): the legacy intents (GET /deviceManagement/intents with /deviceManagement/templates) and the settings catalog (GET /deviceManagement/configurationPolicies). It matches the ASR category by template name, or by the endpointSecurityAttackSurfaceReduction family. Pass if any policy exists; failure otherwise.
How to fix it
Microsoft Intune admin centre → Endpoint security → Attack surface reduction → Create policy. Open the admin centre.
Account protection (LAPS / Hello) policy configured high Moderate CIS 5.1.4.5 CE · Secure configuration
What it checks
Checks that local accounts on devices are protected by policy, through rotating local admin passwords or Windows Hello requirements. Technically: at least one endpoint-security Account protection policy exists.
Why it matters
Identical or unmanaged local administrator passwords let an attacker who compromises one machine move laterally to all of them with the same credential.
What Orbit reads
Orbit reads both endpoint-security deployment models (beta): the legacy intents (GET /deviceManagement/intents with /deviceManagement/templates) and the settings catalog (GET /deviceManagement/configurationPolicies). It matches the Account protection category by LAPS / Windows Hello template names, or by the endpointSecurityAccountProtection / …LocalUser / …LocalAdminPassword families. Pass if any policy exists; failure otherwise.
How to fix it
Microsoft Intune admin centre → Endpoint security → Account protection → Create policy (Local admin password solution for LAPS). Open the admin centre.
Update Management
Windows Update ring configured high Moderate CE · Security update management
What it checks
Checks that Windows security updates are rolled out under central control. Technically: at least one Windows Update for Business update ring exists.
Why it matters
Without update rings, patching depends on each device's own Windows Update behaviour. Deferred, metered or paused devices quietly fall months behind on security fixes.
What Orbit reads
Orbit reads GET /deviceManagement/deviceConfigurations and passes if any configuration is a Windows Update for Business ring (identified by its @odata.type).
How to fix it
Microsoft Intune admin centre → Devices → Windows updates → Update rings → Create profile. Open the admin centre.
Updates install automatically high Quick fix CE · Security update management
What it checks
Checks that update rings actually install updates rather than leaving it to users. Technically: no update ring has automaticUpdateMode set to user-defined or not-configured.
Why it matters
A ring that leaves installation to the user is a ring in name only. Its machines patch only when their users choose to reboot, and some users never do.
What Orbit reads
Orbit reads automaticUpdateMode on each update ring from GET /deviceManagement/deviceConfigurations. A ring counts as non-automatic when the mode is user-defined, not-configured, windowsDefault or notifyDownload (notify only). windowsDefault is "Reset to default" in the portal: it hands behaviour back to the Windows default and doesn't enforce it. Pass when every ring installs automatically; otherwise partial, with the number of rings that fall short. Orbit evaluates the check only when at least one ring exists.
How to fix it
Microsoft Intune admin centre → Devices → Windows updates → Update rings → edit each ring → Automatic update behaviour: Auto install (and restart) at maintenance time. Open the admin centre.
Feature update profile configured medium Moderate CE · Security update management
What it checks
Checks that you choose which Windows version devices run. Technically: at least one Windows feature update profile exists.
Why it matters
Without a feature update profile, devices change Windows version on Microsoft's schedule. Or they stall on a release that is near end of servicing, after which they stop receiving security updates.
What Orbit reads
Orbit reads GET /deviceManagement/windowsFeatureUpdateProfiles (beta). Pass if any profile exists; partial otherwise.
How to fix it
Microsoft Intune admin centre → Devices → Windows updates → Feature updates → Create profile. Open the admin centre.
Device Enrollment
Enrollment platform restrictions configured medium Quick fix CIS 4.2
What it checks
Checks that there are rules about which device types may enrol into management. Technically: at least one device enrolment platform restriction exists.
Why it matters
With no platform restrictions, any user can enrol any device, including personally owned or obsolete platforms. That device then gets the access that managed devices are granted.
What Orbit reads
Orbit reads GET /deviceManagement/deviceEnrollmentConfigurations and passes if a platform-restriction configuration exists.
How to fix it
Microsoft Intune admin centre → Devices → Enrollment → Enrollment device platform restrictions. Open the admin centre.
Per-user device enrollment limit set low Quick fix CIS 5.1.4.2
What it checks
Checks that one account can't enrol an unlimited number of devices. Technically: a device enrolment limit configuration exists.
Why it matters
An unlimited enrolment allowance lets one compromised account register attacker-controlled devices at will, each one inheriting the trust given to managed devices.
What Orbit reads
Orbit reads GET /deviceManagement/deviceEnrollmentConfigurations and looks for a device-limit configuration. Pass if one exists; partial otherwise.
How to fix it
Microsoft Intune admin centre → Devices → Enrollment → Enrollment device limit restrictions. Open the admin centre.
Windows Hello for Business configured medium Moderate CE · User access control
What it checks
Checks that sign-in to Windows devices can use strong, device-bound credentials instead of passwords. Technically: a Windows Hello for Business enrolment configuration exists.
Why it matters
Password-only Windows sign-in keeps a phishable, reusable credential in daily use; Hello's PIN and biometrics are bound to the device and never leave it.
What Orbit reads
Orbit reads GET /deviceManagement/deviceEnrollmentConfigurations and looks for a Windows Hello configuration. Pass if one exists; partial otherwise. Orbit checks only that the configuration exists. It doesn't check whether Hello is set to Enabled inside it.
How to fix it
Microsoft Intune admin centre → Devices → Enrollment → Windows Hello for Business. Open the admin centre.
Autopilot devices have a deployment profile medium Moderate
What it checks
Checks that Windows Autopilot registrations will actually get their intended build. Technically: every Autopilot device identity has a deployment profile in an assigned state.
Why it matters
An Autopilot registration with no profile still enrols, but as an ordinary device. It skips the out-of-box experience, naming and configuration that the profile should apply. The device then looks healthy in Intune, so nothing else shows the gap.
What Orbit reads
Orbit reads GET /deviceManagement/windowsAutopilotDeviceIdentities and counts registrations whose deploymentProfileAssignmentStatus is notAssigned, pending, failed or unknown, showing the serial, model and status. The score is proportional to the number of Autopilot registrations. Tenants that don't use Autopilot have none, so Orbit leaves the check out instead of showing an empty pass.
How to fix it
Microsoft Intune admin centre → Devices → Enrollment → Windows Autopilot → Deployment Profiles → confirm a profile targets the group the device lands in (group tags are the usual mechanism), then re-sync. Open the admin centre.
Apple MDM push certificate valid critical Quick fix
What it checks
Checks that the Apple MDM push (APNs) certificate is valid and not expiring within 30 days. Technically: the certificate's expirationDateTime is more than 30 days away.
Why it matters
Every management command to every iPhone, iPad and Mac travels through this one certificate. When it expires, management of all your Apple devices stops overnight. If you renew it with a different Apple ID, you must re-enrol every device. The warning window therefore matters as much as the expiry.
What Orbit reads
Orbit reads GET /deviceManagement/applePushNotificationCertificate. Pass with more than 30 days of validity; partial inside 30 days; failure when expired. Tenants without the certificate (no Apple management) don't see the check.
How to fix it
Microsoft Intune admin centre → Devices → Enrollment → Apple MDM Push certificate → renew, signing in with the same Apple ID that created it (shown on the check). Open the admin centre.
Apple VPP tokens valid medium Quick fix
What it checks
Checks that Apple Volume Purchase Programme (apps and books) tokens are valid and not expiring within 30 days. Technically: every VPP token's state is valid and its expirationDateTime is over 30 days away.
Why it matters
An expired VPP token raises no errors that users would report. App deployment and updates silently stop for every app bought through it.
What Orbit reads
Orbit reads GET /deviceAppManagement/vppTokens. Pass when every token is valid with over 30 days left; partial when any expires within 30 days; failure when any is expired or in a failed state. Tenants without VPP tokens don't see the check.
How to fix it
Microsoft Intune admin centre → Tenant administration → Connectors and tokens → Apple VPP tokens → renew in Apple Business Manager and upload the new token. Open the admin centre.
Automated Device Enrollment tokens valid medium Quick fix
What it checks
Checks that Apple Automated Device Enrollment (ADE, formerly DEP) tokens are valid and not expiring within 30 days. Technically: every ADE onboarding token's tokenExpirationDateTime is over 30 days away.
Why it matters
ADE is how new corporate Apple devices enrol hands-free. With an expired token, newly purchased devices can't enrol and sit unused until someone renews the token.
What Orbit reads
Orbit reads GET /deviceManagement/depOnboardingSettings (beta). Pass when every token has over 30 days left; partial within 30 days; failure when expired. Tenants without ADE tokens don't see the check.
How to fix it
Microsoft Intune admin centre → Devices → Enrollment → Enrollment program tokens → renew in Apple Business Manager and upload. Open the admin centre.
Managed Google Play connection healthy medium Quick fix
What it checks
Checks that the managed Google Play binding behind Android Enterprise is healthy. Technically: the Android managed store account's bindStatus is boundAndValidated and the last app sync succeeded.
Why it matters
Android Enterprise enrolment and app management run through this binding. When it degrades, Android app deployment fails quietly until someone repairs the connection.
What Orbit reads
Orbit reads GET /deviceManagement/androidManagedStoreAccountEnterpriseSettings (beta). Pass when bound-and-validated with a successful last sync; partial otherwise. Tenants that never bound managed Google Play don't see the check.
How to fix it
Microsoft Intune admin centre → Tenant administration → Connectors and tokens → Managed Google Play → re-approve or re-bind the connection. Open the admin centre.
Configuration Hygiene
No unassigned policies medium Quick fix
What it checks
Checks that every Intune policy actually applies to someone. Technically: every compliance policy, configuration profile, settings-catalog policy and app-protection policy has at least one assignment.
Why it matters
An unassigned policy protects nobody but looks deployed. A review that only reads what the policies say will find the devices configured. This is the single most common gap that dedicated Intune tools exist to catch.
What Orbit reads
Orbit fetches each policy collection with $expand=assignments and flags policies whose assignment list is empty. The score is proportional to the number of policies. Orbit leaves out policies from snapshots taken before it collected assignments, and does not read them as unassigned.
How to fix it
Microsoft Intune admin centre → the flagged policy → Assignments → add the intended group (or All devices / All users), or delete the policy if it was abandoned. Open the admin centre.
No assignments target deleted or empty groups medium Quick fix
What it checks
Checks that group-targeted assignments point at groups that still exist and have members. Technically: every include/exclude group target resolves to a directory group with at least one member.
Why it matters
An assignment to a deleted or empty group is in effect an unassigned policy. The deployment looks correct in the portal and reaches no device.
What Orbit reads
Orbit resolves each assignment's groupId against the directory's group list (taken from the Entra ID hub data). A missing id is a deleted group; a present group with no members is an empty one. Pass with none; partial otherwise.
How to fix it
Microsoft Intune admin centre → the flagged policy → Assignments → re-target a live, populated group. Open the admin centre.
Every device platform has a compliance policy high Moderate
What it checks
Checks that each platform with managed devices has an assigned compliance policy. Technically: for every operating system among managed devices (Windows, iOS/iPadOS, Android, macOS), a compliance policy of that platform type exists and is assigned.
Why it matters
Compliance is evaluated per platform. A tenant with a strict Windows policy and two hundred iPhones that no policy covers has an iPhone problem it can't see. Every compliant-device Conditional Access grant lets those devices through.
What Orbit reads
Orbit maps managed devices' operatingSystem values against compliance policies' @odata.type platforms, counting only assigned policies. The score is proportional to the number of platforms among your devices.
How to fix it
Microsoft Intune admin centre → Devices → Compliance → create and assign a policy for each uncovered platform. Open the admin centre.
Overlapping policies agree on shared settings medium Moderate
What it checks
Checks that no two settings-catalog policies with overlapping assignments configure the same setting to different values. Technically: take every pair of assigned configurationPolicies whose inclusion targets overlap (a shared group, or either targeting all devices/users). Every settingDefinitionId that the pair shares carries the same value.
Why it matters
When two assigned policies disagree on a setting, the value a device gets depends on check-in order. Devices in the overlap split between states, and the fault is hard to trace.
What Orbit reads
Orbit reads each settings-catalog policy's setting instances (beta, capped at 60 policies) and compares values across every overlapping assigned pair. It ignores assignment exclusions and filters. Findings are therefore prompts to review: they can over-report overlap but never under-report it. Pass when overlapping policies agree; partial otherwise, naming each setting and the two policies.
How to fix it
Microsoft Intune admin centre → Devices → Configuration → give each flagged setting a single owning policy, or re-scope the assignments so the policies no longer overlap. Open the admin centre.
Teams
Governance
Every Team has an owner medium Quick fix
What it checks
Checks that every Team has somebody responsible for it. Technically: no Team's owners list is empty.
Why it matters
An ownerless Team has nobody to approve membership, review guests or delete stale content. Requests and access reviews go nowhere, and unmanaged content builds up with nobody accountable.
What Orbit reads
Orbit lists Teams-provisioned groups via GET /groups filtered on resourceProvisioningOptions, expanding owners, and flags Teams with none. Pass when none are ownerless; failure otherwise.
How to fix it
Teams admin centre → Teams → Manage teams → assign an owner to each flagged Team. Open the admin centre.
Teams have at least two owners low Quick fix
What it checks
Checks that no Team depends on a single person. Technically: no Team has exactly one owner.
Why it matters
A single-owner Team becomes ownerless the day that person leaves. Until someone notices, nobody can manage its membership or guests.
What Orbit reads
Orbit lists Teams-provisioned groups via GET /groups filtered on resourceProvisioningOptions, expanding owners, and flags Teams with exactly one owner. Pass when none; partial otherwise.
How to fix it
Teams admin centre → Teams → Manage teams → add a second owner to each flagged Team. Open the admin centre.
Every Team has an active owner medium Quick fix
What it checks
Checks that Team owners are real, working accounts. Technically: every Team with owners has at least one whose account is enabled.
Why it matters
A Team owned only by disabled accounts, typically leavers, is ownerless in practice. Nobody can approve or remove members, although the directory shows an owner.
What Orbit reads
Orbit lists Teams-provisioned groups via GET /groups filtered on resourceProvisioningOptions, expanding owners, and checks accountEnabled on each owner. Pass when every owned Team has an enabled owner; failure otherwise.
How to fix it
Teams admin centre → Teams → Manage teams → replace disabled owners on the flagged Teams. Open the admin centre.
No guest Team owners high Quick fix
What it checks
Checks that people outside the organisation don't control Teams. Technically: no Team owner has userType guest.
Why it matters
A guest owner is an external account that your organisation doesn't control. That account can add members, invite further guests and change settings on a Team full of your data.
What Orbit reads
Orbit lists Teams-provisioned groups via GET /groups filtered on resourceProvisioningOptions, expanding owners, and checks userType on each owner. Pass when no owner is a guest; failure otherwise.
How to fix it
Teams admin centre → Teams → Manage teams → remove guest owners; prevent recurrence with the external collaboration settings in the Microsoft Entra admin centre. Open the admin centre.
No empty Teams low Quick fix
What it checks
Checks for Teams with no members at all. Technically: no Team's member list is empty.
Why it matters
Empty Teams are clutter that can still be attacked. Their SharePoint sites, mailboxes and sharing settings remain, and no member watches them.
What Orbit reads
Orbit lists Teams-provisioned groups via GET /groups filtered on resourceProvisioningOptions, expanding members, and flags Teams with no members. Pass when none; partial otherwise.
How to fix it
Teams admin centre → Teams → Manage teams → archive or delete the empty Teams. Open the admin centre.
No public Teams medium Moderate CIS 1.2.1
What it checks
Checks that Teams aren't open for anyone in the organisation to join unseen. Technically: no Team has visibility set to public.
Why it matters
Any user can join a public Team, and so can a compromised account. They can read its entire file library and message history, and nobody approves or notices.
What Orbit reads
Orbit reads visibility per Team from the Teams group list. Pass when none are public; partial otherwise.
How to fix it
Teams admin centre → Teams → Manage teams → set flagged Teams to Private (review whether each is deliberate first). Open the admin centre.
Teams with guests reviewed medium Moderate
What it checks
Checks which Teams currently contain external guests, for regular review. Technically: Teams whose guest count in the Teams activity report is above zero.
Why it matters
Guest access outlives projects: an external partner keeps reading a Team's files until someone removes them, and without review nobody does.
What Orbit reads
Orbit reads guest counts from GET /reports/getTeamsTeamActivityDetail(period='D90') (falling back to sampled membership when the report is unavailable) and lists Teams with guests. Pass when none have guests; partial otherwise. This is a prompt to review, not a fault.
How to fix it
Teams admin centre → Teams → Manage teams → review the guest list of each flagged Team and remove finished collaborations. Open the admin centre.
No dormant Teams low Moderate
What it checks
Checks for Teams nobody has used in three months. Technically: no Team's last activity date in the activity report is older than 90 days.
Why it matters
Dormant Teams keep their files shared and their guests attached long after the work ended. The data stays exposed, with no active members to notice.
What Orbit reads
Orbit reads last-activity dates from GET /reports/getTeamsTeamActivityDetail(period='D90') and flags Teams inactive for over 90 days or missing from the report. Pass when none; partial otherwise. Orbit evaluates the check only when the usage report is available.
How to fix it
Teams admin centre → Teams → Manage teams → archive or delete dormant Teams (an expiration policy automates this; see the Policies report). Open the admin centre.
Meeting Safety
Anonymous users can't start meetings high Quick fix CE · Secure configuration
What it checks
Checks that no meeting policy lets anonymous users initiate a meeting. Technically: no meetingPolicy has AllowAnonymousUsersToStartMeeting true.
Why it matters
An anonymous participant who can start the meeting controls it before anyone from your organisation arrives. Your meeting links then give an unauthenticated person a way in.
What Orbit reads
Orbit reads the meetingPolicy resources from the Microsoft Tenant Configuration Management (TCM) snapshot of your tenant. Pass when no policy allows it; failure otherwise, listing the policies.
How to fix it
Teams admin centre → Meetings → Meeting policies → turn off "Anonymous users can start a meeting" in each flagged policy. Open the admin centre.
External joiners wait in the lobby high Quick fix CE · Secure configuration
What it checks
Checks that people from outside the organisation are held in the lobby. Technically: no meetingPolicy sets AutoAdmittedUsers to Everyone (partial when federated users bypass via EveryoneInSameAndFederatedCompany).
Why it matters
The lobby is the one human checkpoint between a leaked meeting link and a seat in the meeting; admitting everyone automatically removes it.
What Orbit reads
Orbit reads AutoAdmittedUsers on each meetingPolicy from the configuration snapshot. Pass when external joiners wait; partial when federated users skip the lobby; failure when everyone is auto-admitted.
How to fix it
Teams admin centre → Meetings → Meeting policies → set "Who can bypass the lobby" to people in the organisation (or invited users only). Open the admin centre.
Dial-in callers can't bypass the lobby medium Quick fix
What it checks
Checks that phone (PSTN) callers wait in the lobby. Technically: no meetingPolicy has AllowPSTNUsersToBypassLobby true.
Why it matters
A phone number is not an identity. A dial-in participant who skips the lobby joins invisibly, hears everything, and shows up as a number.
What Orbit reads
Orbit reads AllowPSTNUsersToBypassLobby on each meetingPolicy from the configuration snapshot. Pass when none allow the bypass; partial otherwise.
How to fix it
Teams admin centre → Meetings → Meeting policies → turn off "People dialing in can bypass the lobby". Open the admin centre.
External participants can't take control medium Quick fix
What it checks
Checks that external participants can't be given control of shared content. Technically: no meetingPolicy has AllowExternalParticipantGiveRequestControl true.
Why it matters
If you give an outsider control of a shared screen, they get a remote-control session on an employee's machine, inside a meeting that looks trusted. A family of support-scam attacks works this way.
What Orbit reads
Orbit reads AllowExternalParticipantGiveRequestControl on each meetingPolicy from the configuration snapshot (scored only when the snapshot carries the field). Pass when none allow it; partial otherwise.
How to fix it
Teams admin centre → Meetings → Meeting policies → turn off "External participants can give or request control". Open the admin centre.
Open federation is limited medium Moderate
What it checks
Checks that external Teams access is off or limited to named domains. Technically: the federationConfiguration has AllowFederatedUsers false, or an AllowedDomains list.
Why it matters
Open federation lets any Teams organisation in the world start chats and calls with your users. Recent mass-phishing campaigns use this channel to bypass email filtering entirely.
What Orbit reads
Orbit reads the federationConfiguration from the configuration snapshot. Pass when federation is off or domain-limited; partial when open to everyone.
How to fix it
Teams admin centre → Users → External access → allow only specific external domains (or block external access if unused). Open the admin centre.
Consumer accounts can't reach your users medium Quick fix CE · Secure configuration
What it checks
Checks that personal Teams and Skype accounts can't contact your users. Technically: the federationConfiguration has AllowTeamsConsumer and AllowPublicUsers false.
Why it matters
Consumer accounts are free, anonymous and unmanaged, which is exactly what a phisher registers. Blocking them closes the side door that corporate federation controls don't cover.
What Orbit reads
Orbit reads AllowTeamsConsumer and AllowPublicUsers from the configuration snapshot's federationConfiguration. Pass when both are blocked; partial otherwise.
How to fix it
Teams admin centre → Users → External access → block contact with Teams consumer and Skype users. Open the admin centre.
Policies
Team / group creation restricted medium Moderate CIS 5.1.3.4
What it checks
Checks that not every user can create Teams and Microsoft 365 Groups at will. Technically: the Group.Unified directory setting has EnableGroupCreation set to false.
Why it matters
Unrestricted creation produces sprawl that nobody governs: hundreds of ownerless, duplicate or abandoned Teams, each with its own shareable site.
What Orbit reads
Orbit reads the Group.Unified template values from GET /groupSettings and checks EnableGroupCreation is "false". The setting exists only after someone customises it, so a tenant on Microsoft defaults scores partial (creation open to all).
How to fix it
Set via Microsoft Graph PowerShell: update the Group.Unified directory setting (EnableGroupCreation=false, GroupCreationAllowedGroupId=<group>). No portal toggle exists. Open the admin centre.
Group naming policy configured low Quick fix
What it checks
Checks that new groups follow a naming convention. Technically: Group.Unified's PrefixSuffixNamingRequirement is non-empty.
Why it matters
Without a naming policy, look-alike and joke names build up. Users can create groups that impersonate official ones, and admins can't tell approved workspaces from abandoned experiments.
What Orbit reads
Orbit reads PrefixSuffixNamingRequirement from the Group.Unified values in GET /groupSettings. Pass when set; partial otherwise (including tenants on defaults).
How to fix it
Microsoft Entra admin centre → Identity → Groups → Group settings → Naming policy. Open the admin centre.
Group classification or sensitivity labels enabled medium Moderate
What it checks
Checks that Teams and groups can be marked by confidentiality. Technically: Group.Unified has EnableMIPLabels true or a non-empty ClassificationList.
Why it matters
Unlabelled workspaces give members no signal about what may be stored or shared there. A Confidential project team and a social club look identical.
What Orbit reads
Orbit reads EnableMIPLabels and ClassificationList from GET /groupSettings. Pass when either is configured; partial otherwise.
How to fix it
Enable sensitivity labels for groups (Purview portal → Information protection) or set a classification list via the Group.Unified directory setting. Open the admin centre.
Group expiration policy configured medium Quick fix
What it checks
Checks that unused Teams and groups expire automatically. Technically: at least one group lifecycle policy exists.
Why it matters
Without expiry, every Team ever created persists forever with its files and guests. Cleanup of inactive Teams then depends entirely on people remembering.
What Orbit reads
Orbit reads GET /groupLifecyclePolicies and passes if any policy exists; partial otherwise.
How to fix it
Microsoft Entra admin centre → Identity → Groups → Group settings → Expiration. Open the admin centre.
Guest access to groups controlled high Quick fix
What it checks
Checks that adding external guests to Teams and groups is a deliberate decision, not a default. Technically: Group.Unified.Guest has AllowToAddGuests set to false.
Why it matters
When any member can add any guest, external access to internal files is granted ad hoc with no approval step and no record of why.
What Orbit reads
Orbit reads AllowToAddGuests from the Group.Unified.Guest template in GET /groupSettings. Pass when false; partial otherwise (Microsoft's default allows guests).
How to fix it
Set the Group.Unified.Guest directory setting (AllowToAddGuests=false) via Microsoft Graph PowerShell, or control per-group in the Microsoft Entra admin centre. Open the admin centre.
Guests can't own Teams / groups high Quick fix
What it checks
Checks that external guests can't be made owners of Teams or groups. Technically: Group.Unified has AllowGuestsToBeGroupOwner set to false.
Why it matters
A guest owner controls the membership and settings of a Team or group, and can invite further external accounts. Your organisation doesn't control the guest's account.
What Orbit reads
Orbit reads AllowGuestsToBeGroupOwner from GET /groupSettings. Pass when false; partial otherwise (default permits it).
How to fix it
Set AllowGuestsToBeGroupOwner=false in the Group.Unified directory setting via Microsoft Graph PowerShell. Open the admin centre.
Guest invitations restricted medium Quick fix CIS 5.1.6.3
What it checks
Checks that inviting new external users is restricted, and is not open to everyone, guests included. Technically: the authorization policy's allowInvitesFrom is none or adminsAndGuestInviters.
Why it matters
With open invitations, any member or existing guest can bring arbitrary external accounts into the directory. The result is guest sprawl with no approval step.
What Orbit reads
Orbit reads allowInvitesFrom from GET /policies/authorizationPolicy. Pass when restricted to admins and guest inviters (or off); partial otherwise.
How to fix it
Microsoft Entra admin centre → Identity → External Identities → External collaboration settings → Guest invite settings. Open the admin centre.
SharePoint
External Sharing
External sharing restricted critical Moderate CIS 7.2.3
What it checks
Checks how widely SharePoint and OneDrive content can be shared outside the organisation. Technically: the tenant sharingCapability is disabled or restricted to existing guests; sharing open to new or anonymous users scores lower.
Why it matters
Tenant-wide open sharing means any user can hand company files to any external address. It is the widest possible exposure of your data, and most accidental leaks start there.
What Orbit reads
Orbit reads sharingCapability from GET /admin/sharepoint/settings. Disabled or existing-guests-only passes; new-guests-only is partial; anyone-with-the-link sharing is a failure.
How to fix it
SharePoint admin centre → Policies → Sharing → set the organisation-level external sharing slider; Set-SPOTenant -SharingCapability for scripted change.
Sharing restricted by domain medium Moderate
What it checks
Checks that external sharing, where allowed, is limited to known partner organisations. Technically: sharingDomainRestrictionMode is allowList or blockList (passes automatically if sharing is off entirely).
Why it matters
Without domain restrictions, "external sharing" means sharing with literally any address (competitor, personal webmail or typo), not just the partners you intend.
What Orbit reads
Orbit reads sharingDomainRestrictionMode from GET /admin/sharepoint/settings. Pass when a domain list is enforced or sharing is disabled; partial otherwise.
How to fix it
SharePoint admin centre → Policies → Sharing → Limit external sharing by domain.
Guests can't reshare high Quick fix CIS 7.2.5
What it checks
Checks that external guests can't pass shared content on to further outsiders. Technically: isResharingByExternalUsersEnabled is false (passes if sharing is off entirely).
Why it matters
Resharing lets access spread beyond the person you chose to trust. One guest forwards the link and the audience becomes unknowable.
What Orbit reads
Orbit reads isResharingByExternalUsersEnabled from GET /admin/sharepoint/settings. Pass when false or sharing is disabled; partial otherwise.
How to fix it
SharePoint admin centre → Policies → Sharing → untick "Allow guests to share items they don't own".
Tenant Security
Legacy authentication disabled medium Quick fix CIS 7.2.1 CE · User access control
What it checks
Checks that old sign-in protocols that skip modern security are blocked for SharePoint. Technically: isLegacyAuthProtocolsEnabled is false in the SharePoint tenant settings.
Why it matters
Legacy protocols authenticate with only a username and password, with no MFA and no Conditional Access. That makes them the standard route for password-spray and credential-stuffing attacks.
What Orbit reads
Orbit reads isLegacyAuthProtocolsEnabled from GET /admin/sharepoint/settings. Pass only when explicitly false; failure otherwise.
How to fix it
SharePoint admin centre → Policies → Access control → Apps that don't use modern authentication → Block; Set-SPOTenant -LegacyAuthProtocolsEnabled $false.
Idle session sign-out enabled medium Quick fix CIS 1.3.2
What it checks
Checks that inactive SharePoint sessions on shared or unmanaged machines are signed out automatically. Technically: idleSessionSignOut.isEnabled is true.
Why it matters
On a shared, library or home machine, an abandoned signed-in browser session gives the next user the previous user's files. That lasts until the session expires by itself.
What Orbit reads
Orbit reads idleSessionSignOut from GET /admin/sharepoint/settings. Pass when enabled; partial otherwise.
How to fix it
SharePoint admin centre → Policies → Access control → Idle session sign-out.
OneDrive sync restricted to managed devices high Moderate
What it checks
Checks that whole libraries can't be synced down to unmanaged personal computers. Technically: isUnmanagedSyncAppForTenantRestricted is true.
Why it matters
The sync client copies entire document libraries to local disk. On an unmanaged device, that is a full offline copy of corporate data outside encryption, wipe and DLP controls.
What Orbit reads
Orbit reads isUnmanagedSyncAppForTenantRestricted from GET /admin/sharepoint/settings. The check also passes when an enabled Conditional Access policy on Office 365 or SharePoint requires a compliant or domain-joined device, or applies app-enforced restrictions. The admin centre's Unmanaged devices control creates that policy. Partial when neither is in place.
How to fix it
SharePoint admin centre → Policies → Access control → Unmanaged devices → Block access (or "Allow limited, web-only access"). This creates the Conditional Access policy for you and needs Entra ID P1; allow a day for it to take effect. The old domain-join route (Set-SPOTenantSyncClientRestriction) only suits tenants with on-premises AD.
Self-service site creation restricted medium Quick fix
What it checks
Checks that users can't create new SharePoint sites outside governance. Technically: isSiteCreationEnabled is false.
Why it matters
Self-service sites appear with their own permissions and sharing settings, and nobody is accountable for them. Security reviews never see this content.
What Orbit reads
Orbit reads isSiteCreationEnabled from GET /admin/sharepoint/settings. Pass when false; partial otherwise.
How to fix it
SharePoint admin centre → Settings → Site creation → turn off "Users can create SharePoint sites".
Sites & Storage
No sites with 'Anyone' links critical Moderate CIS 7.2.7
What it checks
Checks that no site is sharing files via links that work for anybody on the internet. Technically: no active site reports anonymous ("Anyone") links in the SharePoint usage report.
Why it matters
An Anyone link is unauthenticated access. There is no sign-in and no audit trail of who used it. It keeps working for whoever gets the URL, whether it was forwarded, indexed or scraped.
What Orbit reads
Orbit reads the Anonymous Link Count per site from GET /reports/getSharePointSiteUsageDetail(period='D90') (beta; v1.0 omits link counts) and flags sites with any. Pass when none; partial otherwise.
How to fix it
SharePoint admin centre → Sites → Active sites → review each flagged site's sharing links; tighten the site-level sharing setting to disallow Anyone links.
Sites shared with guests reviewed medium Moderate
What it checks
Checks which sites are currently shared with external guests, for regular review. Technically: active sites with a non-zero secure-guest-link count in the usage report.
Why it matters
Guest links accumulate: access granted for a project outlives it, and each forgotten link is standing external access to internal content.
What Orbit reads
Orbit reads the Secure Link For Guest Count per site from GET /reports/getSharePointSiteUsageDetail(period='D90') (beta) and lists sites with guests. Pass when none; partial otherwise. This is a prompt to review, not a fault.
How to fix it
SharePoint admin centre → Sites → Active sites → review external access per flagged site.
No dormant sites low Moderate
What it checks
Checks for sites nobody has touched in three months. Technically: no active site's last activity date in the usage report is older than 90 days.
Why it matters
Dormant sites keep their content shared and their permissions live, with no active users to notice misuse. They add risk and have no business value.
What Orbit reads
Orbit reads Last Activity Date per site from GET /reports/getSharePointSiteUsageDetail(period='D90') and flags sites inactive for over 90 days (or with no recorded activity). Pass when none; partial otherwise.
How to fix it
SharePoint admin centre → Sites → Active sites → archive or delete dormant sites after owner review.
No orphaned OneDrive accounts medium Moderate
What it checks
Checks for OneDrive still holding files after the person who owned them left. Technically: no undeleted OneDrive has an owner whose account is disabled or carries no assigned licence.
Why it matters
A OneDrive outlives the account that owned it. An offboarded employee's files stay live, stay shared with the same people, and are outside anyone's review. The organisation keeps the liability but not the owner.
What Orbit reads
Orbit joins the OneDrive usage report (GET /reports/getOneDriveUsageAccountDetail) to the directory (GET /users) on owner principal name. It flags any drive whose owner is disabled or unlicensed. Orbit leaves out deleted drives, and drives whose owner it can't find in the directory, instead of guessing. Microsoft's report covers licensed users but keeps recently-offboarded accounts for up to 180 days. The check therefore finds what a recent leaver left behind, not a site orphaned years ago.
How to fix it
SharePoint admin centre → More features → User profiles → Manage user profiles → transfer the OneDrive to the leaver's manager, or set a retention policy and delete it. Microsoft 365 admin centre → Users → the account → OneDrive tab gives the same access-and-transfer route.
Sites within storage quota low Quick fix
What it checks
Checks that no site is about to hit its storage ceiling. Technically: no active site's storage used is 90% or more of its allocation.
Why it matters
A site that reaches its quota stops accepting uploads. Users get save errors in the middle of their work, and the failure looks like data loss until someone finds the cause.
What Orbit reads
Orbit compares Storage Used against Storage Allocated per site from GET /reports/getSharePointSiteUsageDetail(period='D90') and flags sites at 90% or above. Orbit skips sites with no allocation recorded. Pass when none are near quota; partial otherwise.
How to fix it
SharePoint admin centre → Sites → Active sites → raise the flagged sites' storage limit or archive content.
Exchange
Email Authentication
SPF record published on every domain high Quick fix CIS 2.1.8
What it checks
Checks that every email domain declares which servers may send mail as it. Technically: each verified custom domain publishes exactly one SPF (v=spf1) TXT record in public DNS.
Why it matters
Without SPF, any server on the internet can send mail that claims to be from your domain, and receiving systems have no basis to reject it. Invoice fraud and phishing in your name depend on this.
What Orbit reads
Orbit queries public DNS (not Graph) for TXT records at each domain apex and requires exactly one v=spf1 record. Multiple SPF records are invalid, so Orbit flags them too. Domains come from GET /domains (verified, custom; onmicrosoft.com excluded). Orbit excludes domains whose DNS lookup fails from scoring. It does not fail them.
How to fix it
Add a TXT record at your DNS registrar, e.g. "v=spf1 include:spf.protection.outlook.com -all"; the Microsoft 365 admin centre's Domains page shows each domain's expected value. Open the admin centre.
SPF enforces hard fail (-all) medium Quick fix CIS 2.1.8
What it checks
Checks that the SPF record tells receivers to reject unauthorised senders outright. Technically: each SPF record ends in -all (hard fail) rather than ~all or a missing all mechanism.
Why it matters
A soft fail (~all) asks receivers only to note forgeries, not to reject them. Spoofed mail is still delivered, with only a small increase in its spam score.
What Orbit reads
Orbit reads the final qualifier of each domain's SPF record from public DNS. All -all passes; ~all everywhere is partial; if any domain has neither, the score is proportional to the number of domains. Orbit evaluates only domains that have SPF.
How to fix it
Edit the SPF TXT record at your registrar to end in -all once you've confirmed all legitimate senders are listed (check DMARC reports first to avoid breaking real mail). Open the admin centre.
DKIM signing configured for every domain high Quick fix CIS 2.1.9
What it checks
Checks that outgoing mail is cryptographically signed so receivers can verify it wasn't altered or forged. Technically: both Microsoft 365 DKIM selector records (selector1 and selector2) exist in each domain's DNS.
Why it matters
Unsigned mail can be spoofed or altered in transit without detection. DMARC is the layer that blocks spoofing, and it can't reach enforcement without DKIM alignment.
What Orbit reads
Orbit queries public DNS for CNAME (or TXT) records at selector1._domainkey.<domain> and selector2._domainkey.<domain> and requires both. Domains that sign with custom selector names show as missing. Treat that result as a false positive.
How to fix it
Microsoft Defender portal → Email authentication settings → DKIM → enable signing per domain, then publish the two CNAME records it gives you at your registrar. Open the admin centre.
DMARC record published on every domain high Quick fix CIS 2.1.10
What it checks
Checks that every domain tells the world what to do with mail that fails authentication. Technically: a v=DMARC1 TXT record exists at _dmarc.<domain> for each verified custom domain.
Why it matters
Without DMARC, SPF and DKIM results are only advisory. Receivers have no instruction to quarantine or reject forgeries, and you get no reports on who is spoofing your domain.
What Orbit reads
Orbit queries public DNS for a TXT record at _dmarc.<domain> per verified custom domain. Orbit excludes unreachable domains from scoring. It does not fail them.
How to fix it
Add a TXT record at _dmarc.<domain> at your registrar, starting at "v=DMARC1; p=none; rua=mailto:…" to gather reports before enforcing. Open the admin centre.
DMARC policy set to quarantine or reject high Moderate CIS 2.1.10
What it checks
Checks that DMARC actually enforces rather than just monitors. Technically: each DMARC record's p= policy is quarantine or reject, not none.
Why it matters
p=none means forged mail is still delivered; the domain is monitored but not protected. Only quarantine or reject makes receivers act on failures.
What Orbit reads
Orbit reads the p= tag of each domain's DMARC record from public DNS. All reject passes; quarantine anywhere (with no p=none) is partial; if any domain has p=none, the score is proportional to the number of domains. Orbit evaluates only domains with a DMARC record.
How to fix it
Edit the _dmarc TXT record at your registrar to p=quarantine, then p=reject once DMARC reports show legitimate mail aligning. Open the admin centre.
DMARC aggregate reports have a recipient low Quick fix
What it checks
Checks that DMARC failure reports actually go somewhere. Technically: each DMARC record carries a non-empty rua= tag naming an aggregate-report recipient.
Why it matters
Without a report recipient, nobody sees what DMARC is rejecting, including who is spoofing the domain and whether legitimate mail is failing alignment. Moving to p=reject safely depends on reading these reports first.
What Orbit reads
Orbit parses the rua= tag from each domain's already-collected DMARC record, with no extra lookup. Pass when every DMARC-publishing domain names a recipient; otherwise the score is proportional to the number of domains.
How to fix it
Add rua=mailto:dmarc-reports@yourdomain (or a DMARC monitoring service's address) to the _dmarc TXT record at your registrar. Open the admin centre.
Mail Security
Modern authentication enforced in Exchange critical Quick fix CE · Secure configuration
What it checks
Checks that Exchange Online only accepts modern (OAuth 2.0) authentication from clients. Technically: the organisation config's OAuth2ClientProfileEnabled is true.
Why it matters
Basic authentication cannot carry MFA, so one phished password is mailbox access. Modern authentication is the switch that makes every Conditional Access and MFA control actually bind to Exchange clients.
What Orbit reads
Orbit reads the organizationConfig resource from the Microsoft Tenant Configuration Management (TCM) snapshot of your tenant. Pass when OAuth2ClientProfileEnabled is true; failure otherwise.
How to fix it
Exchange admin centre → Settings → Modern authentication → turn modern authentication on and disable basic authentication protocols. Open the admin centre.
Mailbox auditing is on high Quick fix
What it checks
Checks that organisation-level mailbox audit logging hasn't been switched off. Technically: organizationConfig AuditDisabled is false.
Why it matters
Mailbox auditing is the forensic record of who read, moved or deleted mail. With it disabled, a mailbox compromise investigation starts blind.
What Orbit reads
Orbit reads AuditDisabled from the configuration snapshot's organizationConfig. Pass when false; failure when true.
How to fix it
Re-enable organisation mailbox auditing: run Set-OrganizationConfig -AuditDisabled $false in Exchange Online PowerShell. Open the admin centre.
Anti-phishing policy is active high Moderate CE · Malware protection
What it checks
Checks that at least one anti-phishing policy is enabled with spoof intelligence on. Technically: an antiPhishPolicy with Enabled true, and no active policy with EnableSpoofIntelligence false.
Why it matters
Anti-phishing policies carry spoof intelligence and the impersonation protections. These are the filters that catch lookalike senders before a user ever judges them.
What Orbit reads
Orbit reads the antiPhishPolicy resources from the configuration snapshot. Pass when an enabled policy exists with spoof intelligence on; partial when spoof intelligence is off or no policy exists; failure when every policy is disabled.
How to fix it
Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Anti-phishing → enable the policy and spoof intelligence (or apply the Standard preset security policy). Open the admin centre.
Common attachment types are blocked high Quick fix CE · Malware protection
What it checks
Checks that malware filter policies block common dangerous attachment types. Technically: every malwareFilterPolicy has EnableFileFilter true.
Why it matters
There is no good reason to receive executables and script files by email. The common-attachments filter removes this whole class of payload before scanning is needed.
What Orbit reads
Orbit reads the malwareFilterPolicy resources from the configuration snapshot. Pass when every policy enables the file filter; partial otherwise, listing the policies that don't.
How to fix it
Microsoft Defender portal → Threat policies → Anti-malware → enable the common attachments filter on each policy. Open the admin centre.
High-confidence phishing is quarantined high Quick fix
What it checks
Checks that mail classified as high-confidence phishing is quarantined, not delivered to junk. Technically: every hostedContentFilterPolicy has HighConfidencePhishAction set to Quarantine.
Why it matters
High-confidence phishing is mail that the filter is most certain about. If it goes to the junk folder, the user is still one click away from it.
What Orbit reads
Orbit reads the hostedContentFilterPolicy resources from the configuration snapshot. Pass when every policy quarantines; partial otherwise.
How to fix it
Microsoft Defender portal → Threat policies → Anti-spam → set the high-confidence phishing action to Quarantine in each policy. Open the admin centre.
Zero-hour auto purge is enabled medium Quick fix CE · Malware protection
What it checks
Checks that zero-hour auto purge (ZAP) is on for phishing and malware. Technically: PhishZapEnabled on each spam policy and ZapEnabled on each malware policy.
Why it matters
ZAP is the only control that acts after delivery. When a message is reclassified as malicious, ZAP removes it from inboxes instead of leaving it to be clicked.
What Orbit reads
Orbit reads the spam and malware filter policies from the configuration snapshot. Pass when ZAP is on everywhere; partial otherwise.
How to fix it
Microsoft Defender portal → Threat policies → re-enable ZAP in the anti-spam and anti-malware policies that turned it off. Open the admin centre.
Auto-forwarding to external recipients is off critical Quick fix CE · Secure configuration
What it checks
Checks that automatic forwarding of mail to external addresses is blocked. Technically: every hostedOutboundSpamFilterPolicy has AutoForwardingMode set to Off.
Why it matters
A silent inbox rule that forwards mail externally is the classic way to keep access after a mailbox compromise. Attackers keep reading mail long after the password changes. A tenant-wide block on auto-forwarding stops this in one step.
What Orbit reads
Orbit reads the hostedOutboundSpamFilterPolicy resources from the configuration snapshot. Pass when every policy sets AutoForwardingMode to Off; failure otherwise.
How to fix it
Microsoft Defender portal → Threat policies → Anti-spam outbound policy → set automatic forwarding to Off. Open the admin centre.
No transport rules silently redirect mail high Moderate
What it checks
Checks for transport rules that redirect or blind-copy mail. Technically: no transportRule sets RedirectMessageTo or BlindCopyTo.
Why it matters
A transport rule that redirects or BCCs mail is invisible to the affected users and survives password resets. Such a rule is legitimate for journaling, but an exfiltration backdoor looks exactly the same. Confirm that each one is intended.
What Orbit reads
Orbit reads the transportRule resources from the configuration snapshot and lists rules with redirect or BCC actions. Pass when none; partial otherwise.
How to fix it
Exchange admin centre → Mail flow → Rules → review each flagged rule and delete any that nobody can vouch for. Open the admin centre.
DKIM signing is enabled in Exchange high Moderate
What it checks
Checks that Exchange Online DKIM-signs outbound mail for every configured domain. Technically: every dkimSigningConfig has Enabled true.
Why it matters
The Email Authentication report checks the DNS records; this checks the signing switch inside Exchange itself. Both must be on before DMARC can align.
What Orbit reads
Orbit reads the dkimSigningConfig resources from the configuration snapshot. Pass when every domain signs; partial when some do; failure when none do.
How to fix it
Microsoft Defender portal → Email authentication settings → DKIM → enable signing for each flagged domain. Open the admin centre.
Users can report phishing medium Quick fix
What it checks
Checks that user-reported messages have somewhere to go. Technically: the reportSubmissionPolicy enables reporting to Microsoft or a customised reporting address.
Why it matters
Users are the detection layer the filters miss; if the Report button is disabled, the security team never hears about the phish that got through.
What Orbit reads
Orbit reads the reportSubmissionPolicy resource from the configuration snapshot. Pass when reporting to Microsoft or a custom address is on; partial otherwise.
How to fix it
Microsoft Defender portal → Settings → Email & collaboration → User reported settings → enable reporting to Microsoft and/or your reporting mailbox. Open the admin centre.
Safe Attachments protects incoming mail high Moderate CE · Malware protection
What it checks
Checks that a Safe Attachments policy is enabled. Technically: a safeAttachmentPolicy with Enable true exists.
Why it matters
Safe Attachments opens attachments in a sandbox before delivery. It catches new malware that signature scanning misses. No enabled policy usually means Defender for Office 365 Plan 1 isn't licensed or was never configured.
What Orbit reads
Orbit reads the safeAttachmentPolicy resources from the configuration snapshot. Pass when an enabled policy exists; partial otherwise.
How to fix it
Microsoft Defender portal → Threat policies → Safe Attachments → create or enable a policy covering all recipients (or apply the Standard preset security policy). Open the admin centre.
Safe Links scans URLs in mail high Moderate CE · Malware protection
What it checks
Checks that a Safe Links policy covers email. Technically: a safeLinksPolicy with EnableSafeLinksForEmail true exists.
Why it matters
Safe Links rewrites URLs and checks them at click time. It still catches a link that turns malicious after delivery, which defends against delayed phishing campaigns.
What Orbit reads
Orbit reads the safeLinksPolicy resources from the configuration snapshot. Pass when an enabled email-scoped policy exists; partial otherwise.
How to fix it
Microsoft Defender portal → Threat policies → Safe Links → create or enable a policy covering all recipients (or apply the Standard preset security policy). Open the admin centre.
Remote domains don't allow auto-forwarding high Quick fix CE · Secure configuration
What it checks
Checks that no remote domain accepts auto-forwarded mail from the organisation. Technically: no remoteDomain resource has AutoForwardEnabled true.
Why it matters
Remote domain settings are the older of Exchange's two auto-forward controls. Today the outbound spam policy usually blocks forwarding. But if a remote domain is left open, mail can leave again on the day someone relaxes that policy.
What Orbit reads
Orbit reads the remoteDomain resources from the configuration snapshot. Pass when none allows auto-forwarding; partial when some do but the outbound spam policy blocks forwarding anyway; failure when forwarding can actually leave.
How to fix it
Exchange admin centre → Mail flow → Remote domains → edit each domain → turn off "Allow automatic forwarding". Open the admin centre.
No inbox rules forward mail outside the organisation critical Quick fix CE · Secure configuration
What it checks
Checks every scanned mailbox's inbox rules for forward, forward-as-attachment or redirect actions whose recipients sit outside the tenant's verified domains. Rules that forward within the organisation pass (they're noted, not flagged).
Why it matters
A quiet rule that forwards mail to an external address is the classic way to keep access after a mailbox compromise. The attacker keeps reading mail long after the password is changed. Well-meaning staff also leak company mail to personal accounts this way.
What Orbit reads
Orbit reads each mailbox's inbox rules through Microsoft Graph. It uses the read-only mailbox-rules permission that the Mail Security setup script (or the grant card on the report) grants. You can revoke it at any time under Enterprise applications in Microsoft Entra. Until that grant exists, the check shows "not connected" and Orbit excludes it from the score. Pass when no enabled rule sends mail externally; partial when such rules exist but the outbound spam policy stops them delivering; failure otherwise.
How to fix it
Confirm each listed rule with the mailbox owner, then remove it: Outlook → Settings → Rules, or Remove-InboxRule -Mailbox <user> in Exchange Online PowerShell. Treat an unexplained rule as a possible compromise and reset the account's credentials and sessions. Open the admin centre.
No inbox rules hide warnings or delete mail unseen high Quick fix
What it checks
Checks every scanned mailbox's inbox rules for ones that delete mail or move security-related messages out of sight. These are rules that delete or move messages matching words like "phishing", "password" or "security", and rules that delete every incoming message.
Why it matters
Attackers pair a forwarding rule with a hiding rule. Warnings from IT, password-reset notices and suspicious-sign-in alerts go straight to Deleted Items, so the owner never sees them. Discuss a rule like this with the mailbox owner, even if it turns out to be innocent.
What Orbit reads
Orbit reads each mailbox's inbox rules through Microsoft Graph. It uses the read-only mailbox-rules permission that the Mail Security setup script grants. The check shows "not connected" until the setup script's mailbox-rules step has run. Failure when a rule deletes matching mail; partial when rules only move it out of the inbox; pass when neither.
How to fix it
Review each listed rule with the mailbox owner and remove any they didn't create: Outlook → Settings → Rules, or Remove-InboxRule -Mailbox <user> in Exchange Online PowerShell. Open the admin centre.
Mailbox Usage
No dormant mailboxes (90+ days) low Moderate
What it checks
Checks for mailboxes nobody has used in three months. Technically: no live mailbox in the usage report has a last-activity date older than 90 days.
Why it matters
Dormant mailboxes are usually leavers' accounts that were never offboarded. They still receive mail and are still licensable. Whoever still has the credentials has a quiet route back in.
What Orbit reads
Orbit reads GET /reports/getMailboxUsageDetail(period='D90') and flags non-deleted mailboxes with no activity in over 90 days (or none recorded). Pass when none; partial while at least 80% of mailboxes are active; failure beyond that. Usage reports lag by up to 48 hours.
How to fix it
Exchange admin centre → Recipients → Mailboxes → convert leavers' mailboxes to shared, or remove them and reclaim the licence. Open the admin centre.
Shared mailboxes can't be signed into critical Quick fix
What it checks
Checks that shared mailboxes can't be logged into directly. Technically: no mailbox the usage report classifies as Shared is backed by a user account with accountEnabled true.
Why it matters
A shared mailbox is meant to be opened through delegation, so its underlying account should stay disabled. If the account is enabled, it is a credential that nobody owns, nobody rotates and nobody has registered MFA against. It is a standing way into the tenant that no leaver process touches.
What Orbit reads
Orbit reads the Recipient Type column of the mailbox usage report (GET /reports/getMailboxUsageDetail) to find shared mailboxes. It joins them to the directory (GET /users) on user principal name and flags any whose account is enabled. The score is proportional to the number of shared mailboxes. When a report version has no Recipient Type column, Orbit skips the check and does not report a pass.
How to fix it
Microsoft 365 admin centre → Users → Active users → open the shared mailbox's account → Block sign-in. Shared mailboxes need no licence and no sign-in; delegated Full Access is what grants users their access. Open the admin centre.
Shared mailboxes are unlicensed low Quick fix
What it checks
Checks that shared mailboxes aren't consuming licences. Technically: no mailbox the usage report classifies as Shared is backed by an account holding an assigned licence.
Why it matters
A shared mailbox needs no licence until it passes 50 GB. A licence on one is usually left over from the conversion of a leaver's user mailbox. You pay for it every month, indefinitely, for nothing.
What Orbit reads
Orbit takes the mailboxes the usage report marks Shared (GET /reports/getMailboxUsageDetail) and joins them to assigned licences (GET /users) on user principal name. It counts those that still hold a licence. The score is proportional to the number of shared mailboxes. Like the "Shared mailboxes can't be signed into" check, Orbit skips this check when the report carries no Recipient Type column.
How to fix it
Microsoft 365 admin centre → Users → Active users → open the shared mailbox's account → Licences and apps → remove the licence. Shared mailboxes only need one above 50 GB or for In-Place Archive. Open the admin centre.
Mailboxes within storage quota medium Quick fix
What it checks
Checks that no mailbox is about to stop sending. Technically: no mailbox's storage used is at 90% or more of its prohibit-send quota.
Why it matters
A mailbox that reaches its send quota stops sending, even mid-conversation. For the user it is an outage. For an unattended mailbox, the failure can go unnoticed for days.
What Orbit reads
Orbit compares Storage Used against Prohibit Send Quota per mailbox from GET /reports/getMailboxUsageDetail(period='D90') and flags mailboxes at 90% or above. Pass when none; partial while they're under 20% of mailboxes; failure beyond that.
How to fix it
Exchange admin centre → Recipients → Mailboxes → enable archiving for the flagged mailboxes or raise their quota. Open the admin centre.
Purview
Information Protection
Sensitivity labels are defined medium Moderate CIS 3.3.1
What it checks
Checks that the organisation has a way to mark documents and emails by confidentiality. Technically: at least one Microsoft Purview sensitivity label exists in the tenant.
Why it matters
Without labels, nothing tells Microsoft 365 what is confidential. Encryption, sharing restrictions and DLP policies have nothing to act on, and every file is handled the same way whatever its sensitivity.
What Orbit reads
Orbit reads GET /security/dataSecurityAndGovernance/sensitivityLabels and passes when any label exists; a readable but empty list is a failure.
How to fix it
Microsoft Purview portal → Information protection → Labels → create a label taxonomy and publish it. Open the admin centre.
Sensitivity labels are enabled medium Quick fix CIS 3.3.1
What it checks
Checks that the labels defined are actually switched on. Technically: every sensitivity label reports isEnabled (or isActive) as true.
Why it matters
A disabled label is invisible to users. Documents that should carry it go unlabelled, and any protection bound to it never applies.
What Orbit reads
Orbit reads the enabled state of each label from GET /security/dataSecurityAndGovernance/sensitivityLabels. Pass when all are enabled; partial while at least 80% are; failure beyond that. Orbit evaluates the check only when labels exist.
How to fix it
Microsoft Purview portal → Information protection → Labels → enable or delete the disabled labels. Open the admin centre.
Copilot
Licensing
Microsoft 365 Copilot is licensed low Quick fix
What it checks
Records whether the tenant owns Microsoft 365 Copilot licences. Technically: a subscribed SKU matching Microsoft 365 Copilot exists.
Why it matters
This check is for information only. The rest of the Copilot hub applies only if Copilot is licensed. The check cannot fail: without the SKU, the hub shows no checks.
What Orbit reads
Orbit reads GET /subscribedSkus and matches the Microsoft 365 Copilot SKU; the note carries the purchased-unit count.
How to fix it
Microsoft 365 admin centre → Billing → Licenses (if you intend to buy Copilot; this check is informational). Open the admin centre.
Copilot licences are assigned low Quick fix
What it checks
Checks that purchased Copilot licences are actually given to users. Technically: the Copilot SKU's consumedUnits is above zero.
Why it matters
An unassigned Copilot licence wastes roughly £25 per seat per month. You have paid for a capability that nobody can use.
What Orbit reads
Orbit reads consumedUnits on the Copilot SKU from GET /subscribedSkus. Pass when any are assigned; partial when all purchased seats sit unassigned.
How to fix it
Microsoft 365 admin centre → Billing → Licenses → Microsoft 365 Copilot → assign to users. Open the admin centre.
Spare Copilot licences minimised medium Quick fix
What it checks
Checks that the tenant isn't paying for substantially more Copilot seats than it uses. Technically: spare units (purchased minus assigned) are within 10% of the purchased total (minimum headroom of one).
Why it matters
At Copilot's per-seat price, spare seats soon become expensive. Seats beyond a sensible margin are recurring spend with no return.
What Orbit reads
Orbit computes prepaidUnits.enabled minus consumedUnits on the Copilot SKU from GET /subscribedSkus and flags spare seats above the 10% allowance. Pass within allowance; partial beyond it.
How to fix it
Microsoft 365 admin centre → Billing → Your products → reduce the Copilot seat count at renewal, or assign the spares. Open the admin centre.
Adoption
Assigned licences are being used medium Moderate
What it checks
Checks that people given Copilot actually use it. Technically: every licensed user in the Copilot usage report shows activity within the last 28 days.
Why it matters
A licence assigned to someone who never uses it is the same waste as an unassigned one, but the licence count hides it. You can reclaim or reassign it at no cost.
What Orbit reads
Orbit reads last-activity dates from GET /reports/getMicrosoft365CopilotUsageUserDetail(period='D90') (beta) and flags users inactive for over 28 days. Pass when none; partial while inactive users are a minority; failure beyond half. Usage reports lag by up to 48 hours.
How to fix it
Microsoft 365 admin centre → Copilot → review usage; reassign inactive seats or run adoption training. Open the admin centre.
Copilot used across multiple apps low Moderate
What it checks
Checks that Copilot use has spread beyond a single app. Technically: at least three of the reported apps (Teams, Outlook, Word, Excel, PowerPoint, OneNote, Loop, Chat) show an active user in the last 90 days.
Why it matters
Copilot confined to one app usually signals a stalled rollout. The licence cost is justified across the suite, not by Teams summaries alone.
What Orbit reads
Orbit reads the per-app last-activity columns of the Copilot usage report and counts apps with at least one active user. Pass at three or more; partial below.
How to fix it
Microsoft 365 admin centre → Copilot → adoption resources; target training at the unused apps. Open the admin centre.
Copilot Chat in active use low Quick fix
What it checks
Checks that the standalone Copilot Chat is being used at all. Technically: at least one user shows Copilot Chat activity in the usage report.
Why it matters
Copilot Chat is useful for the widest range of work and needs no open document. Zero usage indicates that users don't know it exists.
What Orbit reads
Orbit reads the Copilot Chat last-activity column of the usage report; pass when any user is active, partial when none.
How to fix it
Microsoft 365 admin centre → Copilot → tell licensed users that Copilot Chat is available. Open the admin centre.
Licensing
Assignment
No licences on disabled accounts medium Quick fix
What it checks
Checks that blocked or offboarded accounts aren't still consuming paid licences. Technically: no user with accountEnabled false holds any assigned licence.
Why it matters
Licences on disabled accounts are recurring waste. The standard leaver process disables sign-in but forgets the licence, and you keep paying for it indefinitely.
What Orbit reads
Orbit reads accountEnabled and assignedLicenses per user from GET /users and flags disabled licence-holders. Pass when none; partial while they're a minority of licensed users; failure beyond half.
How to fix it
Microsoft 365 admin centre → Billing → Licenses → remove licences from the flagged accounts (after mailbox/data handover). Open the admin centre.
No licences on guest accounts medium Quick fix
What it checks
Checks that external guest accounts aren't holding paid licences. Technically: no user with userType Guest holds an assigned licence.
Why it matters
Guests rarely need licences, because their own organisation licenses them. A licensed guest usually means you are paying for an outsider by mistake.
What Orbit reads
Orbit reads userType and assignedLicenses per user from GET /users and flags licensed guests. Pass when none; partial while a minority; failure beyond half.
How to fix it
Microsoft 365 admin centre → Billing → Licenses → review and remove licences from guest accounts. Open the admin centre.
Unassigned licences minimised medium Quick fix
What it checks
Checks for purchased licences sitting on the shelf. Technically: across all SKUs, prepaidUnits.enabled minus consumedUnits totals zero.
Why it matters
Every unassigned seat is subscription spend with no user attached; across several SKUs the waste compounds quietly at every renewal.
What Orbit reads
Orbit sums spare units per SKU from GET /subscribedSkus and skips free SKUs. It treats any SKU with 10,000 or more prepaid seats as free. Microsoft gives that placeholder allocation to Fabric Free, Power Automate Free and similar, and nobody bought it. Pass at zero paid spare; partial otherwise, listing the spare count per SKU and how many free SKUs were excluded.
How to fix it
Microsoft 365 admin centre → Billing → Your products → reduce seat counts at renewal or assign the spares. Open the admin centre.
No licences in a warning or suspended state high Quick fix
What it checks
Checks that no subscription is in a billing-failure state. Technically: no SKU reports units in prepaidUnits.warning, suspended or lockedOut.
Why it matters
Warning and suspended states precede service shutdown: users lose mail and files access on Microsoft's timetable, not yours, unless billing is fixed first.
What Orbit reads
Orbit reads prepaidUnits per SKU from GET /subscribedSkus and flags any units in warning, suspended or locked-out states. Pass when none; partial otherwise.
How to fix it
Microsoft 365 admin centre → Billing → Your products → resolve the payment or renewal issue on the flagged subscription. Open the admin centre.
Utilisation
Licensed users are active medium Moderate
What it checks
Checks that people holding licences actually sign in. Technically: every enabled licensed user has a sign-in within the last 90 days.
Why it matters
A licence on an account nobody signs into is spend without use. The usual cause is a role change, long-term leave or an incomplete leaver process.
What Orbit reads
Orbit reads signInActivity per user from GET /users and flags licensed users inactive for over 90 days. This needs Entra ID P1. Without it, the report shows an error and does not guess. Pass when none; partial while at least 80% are active; failure beyond that.
How to fix it
Microsoft 365 admin centre → Billing → Licenses → reclaim licences from long-inactive users. Open the admin centre.
No premium licences on inactive users high Quick fix
What it checks
Checks that the most expensive licences aren't parked on inactive accounts. Technically: no user inactive for 90+ days holds a premium SKU (E5 and equivalents).
Why it matters
A premium seat costs several times as much as a standard licence. On an inactive account, the extra cost of the premium licence is the single biggest per-user saving available.
What Orbit reads
Orbit cross-references inactive users (signInActivity, 90-day threshold) against premium SKU assignments resolved via GET /subscribedSkus. Pass when none; partial while at least 80% comply; failure beyond that.
How to fix it
Microsoft 365 admin centre → Billing → Licenses → downgrade or reclaim premium licences on the flagged accounts. Open the admin centre.
Exchange licences are in use low Quick fix
What it checks
Checks that people with an Exchange licence use their mailbox. Technically: every Exchange licence holder has Exchange activity in the last 90 days.
Why it matters
A user can sign in every day and still never use their mailbox. That licence is spend without use, and the inactive-user check does not find it.
What Orbit reads
Orbit reads the Microsoft 365 active users report (GET /reports/getOffice365ActiveUserDetail) for each user's Exchange licence and last Exchange activity. Licences assigned in the last 90 days, deleted users and disabled accounts are not counted. Pass when none are unused; partial while at least 80% are used; failure beyond that.
How to fix it
Microsoft 365 admin centre → Billing → Licenses → remove the Exchange licence or move the user to a plan without it. Open the admin centre.
Teams licences are in use low Quick fix
What it checks
Checks that people with a Teams licence use Teams. Technically: every Teams licence holder has Teams activity in the last 90 days.
Why it matters
A Teams licence on someone who never uses Teams is spend without use. Separate Teams licences cost extra in some regions.
What Orbit reads
Orbit reads the Microsoft 365 active users report (GET /reports/getOffice365ActiveUserDetail) for each user's Teams licence and last Teams activity. Licences assigned in the last 90 days, deleted users and disabled accounts are not counted. Pass when none are unused; partial while at least 80% are used; failure beyond that.
How to fix it
Microsoft 365 admin centre → Billing → Licenses → remove the Teams licence or move the user to a plan without it. Open the admin centre.
OneDrive and SharePoint licences are in use low Quick fix
What it checks
Checks that people with a OneDrive or SharePoint licence use either service. Technically: every holder has OneDrive or SharePoint activity in the last 90 days.
Why it matters
People who never open OneDrive or SharePoint often keep files on local devices instead. Those files have no backup or sharing controls, and the licence is spend without use.
What Orbit reads
Orbit reads the Microsoft 365 active users report (GET /reports/getOffice365ActiveUserDetail) for each user's OneDrive and SharePoint licences and last activity in either. Licences assigned in the last 90 days, deleted users and disabled accounts are not counted. Pass when none are unused; partial while at least 80% are used; failure beyond that.
How to fix it
Microsoft 365 admin centre → Billing → Licenses → review the flagged users, then remove the licence or help them move their files to OneDrive. Open the admin centre.
Microsoft 365 Apps licences are in use low Quick fix
What it checks
Checks that people licensed for the Microsoft 365 Apps use them. Technically: every enabled user whose licence includes Microsoft 365 Apps has app activity in the last 90 days.
Why it matters
The desktop apps are often the main reason for a more expensive plan. A user who never uses them may need only a cheaper web-only plan.
What Orbit reads
Orbit finds licence holders from GET /users and the service plans in GET /subscribedSkus, then reads the Microsoft 365 Apps usage report (GET /reports/getM365AppUserDetail) for 90 days. When the tenant conceals names in reports, Orbit cannot match the two, so the check is not scored. Pass when none are unused; partial while at least 80% are used; failure beyond that.
How to fix it
Microsoft 365 admin centre → Billing → Licenses → move the flagged users to a plan without the desktop apps, or remove the licence. Open the admin centre.
Optimisation
No overlapping licence assignments medium Quick fix
What it checks
Checks that no user holds two licences whose service plans duplicate each other. Technically: for each user with more than one assigned licence, no two of their SKUs share a service plan. Orbit matches plans by service-plan name. It ignores the free EXCHANGE_S_FOUNDATION plan, which is in almost every SKU.
Why it matters
The classic case is a suite plus a standalone product that the suite already includes, for example Business Premium plus Exchange Online Plan 1. One of the two delivers nothing the other doesn't. It is usually left over from a migration or a licence change that nobody cleaned up.
What Orbit reads
Orbit reads each user's assignedLicenses from GET /users and each SKU's servicePlans from GET /subscribedSkus, and flags users where two assigned SKUs share a service plan. Pass when none; partial while at least 80% of licensed users are unaffected; failure beyond that.
How to fix it
Microsoft 365 admin centre → Billing → Licenses → review each flagged user and remove the redundant licence of the pair. Open the admin centre.
Intune licences are being used medium Project
What it checks
Checks that a tenant paying for Intune has devices enrolled in it. Technically: at least one SKU with enabled units includes an Intune service plan, and the managed-device list is not empty. Partial when there are fewer devices than a quarter of Intune-licensed users.
Why it matters
Intune is part of Business Premium and the Enterprise suites, and endpoint management is a large part of what those bundles cost. A tenant with zero enrolled devices is paying for device management and running unmanaged endpoints. That is both a waste and an exposure.
What Orbit reads
Orbit checks GET /subscribedSkus for an INTUNE* service plan on a purchased SKU and counts devices from GET /deviceManagement/managedDevices. Not licensed when no SKU includes Intune; failure when licensed with zero devices; partial when enrolment is under a quarter of licensed seats.
How to fix it
Microsoft Intune admin centre → Devices → set up enrolment for your platforms, starting with Windows automatic enrolment. Open the admin centre.
Entra ID P1 features are in use medium Moderate
What it checks
Checks that a tenant paying for Entra ID P1 has at least one enabled Conditional Access policy, which is P1's headline feature.
Why it matters
Conditional Access is the main reason P1 exists in the bundles that include it. A P1 tenant with no enabled policy is paying for its identity-security tier and enforcing none of it.
What Orbit reads
Orbit derives the licence tier from GET /subscribedSkus service plans (AAD_PREMIUM*) and counts enabled policies from GET /identity/conditionalAccess/policies. Not licensed below P1; failure when P1 is present with no enabled policy.
How to fix it
Microsoft Entra admin centre → Protection → Conditional Access → start from the Conditional Access report's recommended baseline. Open the admin centre.
Purview information protection is in use low Project
What it checks
Checks that a tenant licensed for information protection has defined at least one sensitivity label.
Why it matters
Information protection ships inside Business Premium and the E-plans (Azure Information Protection / Purview). Without a single label defined, classification, protected sharing and Copilot data governance are all paid for and switched off.
What Orbit reads
Orbit checks GET /subscribedSkus for an information-protection service plan (AIP*/MIP*/RMS_S_*) and reads the tenant label list from GET /security/dataSecurityAndGovernance/sensitivityLabels. Not licensed when no SKU includes it; failure when licensed with no labels defined.
How to fix it
Microsoft Purview portal → Information protection → create and publish a starter label set. Open the admin centre.
No checks match those filters — use Reset above to clear them.
Change log
Tuesday 10 November 2026
Checks
- Mail Security checks every mailbox for rules that forward mail outside your organisation, or that delete or hide security messages. Affects scores: Exchange
- Mail Security checks which remote domains allow automatic forwarding. Affects scores: Exchange
- The OneDrive sync check now passes when a Conditional Access policy requires a compliant or domain-joined device for SharePoint. Affects scores: SharePoint
- The check that guests sign in with the invited account is retired. Microsoft removed the setting it read. Affects scores: SharePoint
- The check for licences on disabled accounts no longer counts Teams Phone resource accounts, such as auto attendants and call queues. Affects scores: Licensing
Improved
- Checks for features your licences don't include now show as not licensed. They no longer count against your score. Affects scores: All hubs
- Copilot licensing recognises the education and newer Microsoft 365 Copilot plans. Affects scores: Copilot
- Renewal reminders go to your contacts 7 days before a paid term ends.
- The Mail Security setup scripts have a Copy script button.
Fixed
- Business Premium tenants keep their Purview report.
Fixed UI
- The monthly email header shows the Planet IT logo.
Fixed text
- Clearer wording across the dashboard, reports, check notes, the check reference and emails.
Security
- Orbit's sign-up consent is now fully read-only. Optional permissions are separate, and you grant them only if you choose to.
Tuesday 3 November 2026
New
- Copilot Readiness Report. Five pillars show whether your tenant is ready for Microsoft 365 Copilot, with an optional scan of SharePoint site permissions.
- Mail Security report in the Exchange hub. It checks your Exchange Online and Defender for Office 365 protection policies, with a guided setup. Affects scores: Exchange
- Meeting Safety report in the Teams hub. It checks lobby, anonymous join, dial-in and external access settings. Affects scores: Teams
- Configuration Hygiene report in the Intune hub. It checks for unassigned policies, assignments to deleted or empty groups, compliance coverage and conflicting settings. Affects scores: Intune
- Configuration changes on the History page. Orbit shows what changed in your tenant between refreshes, and who made the change when your audit log records it.
- Voucher codes. A Global Administrator of a trial tenant can redeem a code for full access.
- Global Administrators choose who else in the organisation can sign in to Orbit.
Checks
- Conditional Access gains five checks: compliant or hybrid-joined devices, token protection, authentication transfer, inactive policies and named locations. Affects scores: Entra ID
- App Management gains five checks: the app management policy, paths to Global Administrator, unsafe redirect URIs, the app instance property lock and app owners without MFA. Affects scores: Entra ID
- App Management flags redirect URIs on domains that no longer exist. Affects scores: Entra ID
- Users & Groups flags apps that hold privileged directory roles. Affects scores: Entra ID
- Users & Groups gains Privileged Identity Management and access review checks. Affects scores: Entra ID
- Guests checks self-service sign-up, email-verified self-join, cross-tenant access defaults and partner access. Affects scores: Entra ID
- Device Enrollment checks the APNs certificate, the VPP and ADE tokens and the managed Google Play connection. Affects scores: Intune
- Email Authentication checks that DMARC reports go to an address. Affects scores: Exchange
Improved
- The dashboard shows your top 5 risks.
- Export your daily scores as CSV from the History page.
- Long evidence lists show every item, behind a Show more button.
- Scores show as a coloured number, without the Strong, Fair and At risk labels.
- The monthly email moves to the Monday when the 1st falls on a weekend.
Fixed UI
- One page width, one button colour and one set of styles across Orbit.
Fixed text
- Plainer wording across Orbit's pages.
Tuesday 27 October 2026
New
- The monthly health email. Each month your recipients get your overall health score, each hub's change and your top three risks.
Fixed UI
- Better contrast and clearer card labels on the dashboard.
Tuesday 6 October 2026
New
- An overview video on the Orbit home page.
Improved
- The dashboard lists Planet IT's AB-900 Microsoft 365 Copilot workshop.
Fixed UI
- A tidier top bar and home page layout.
Tuesday 15 September 2026
Improved
- The licensed users count on the History page includes Frontline and Education plans.
Fixed UI
- Updated Microsoft partner badge.
Tuesday 8 September 2026
New
- Paying customers can book a scored walkthrough with Planet IT from the dashboard.
Fixed text
- Clearer home page wording.
Tuesday 1 September 2026 Launch
New
- Orbit launches. It checks your Microsoft 365 tenant against Microsoft's recommendations across eight hubs: Entra ID, Intune, Teams, SharePoint, Exchange, Purview, Copilot and Licensing.
- Each hub and report is scored out of 100, and the dashboard combines them into one overall health score.
- Every report leads with its priority fixes, each linked to the admin centre page where you fix it.
- Checks carry CIS Microsoft 365 Foundations Benchmark and Cyber Essentials references.
- Daily score history and a Modern Work readiness view.
- A free trial with your overall health score and the full Entra ID hub.
- Your Account page holds the Users list and a button to delete everything Orbit stores.
- A live demo on a fictional tenant, with no sign-in.
- Orbit is available on Microsoft Marketplace.
Roadmap
2026
- Data Loss Prevention report A new Purview report checks your data loss prevention policies. It checks that they exist, are enforced rather than in test mode, and cover mail, files, Teams and devices.
- Risky users check Entra ID will flag users that Microsoft rates as high or medium risk. This check needs Microsoft Entra ID P2.
- Wider framework mapping More checks will show the CIS Microsoft 365 Foundations Benchmark and Cyber Essentials controls they support.
- Score drop alerts Orbit will email you when your overall health score drops, so you can act before the next monthly email.
- Free trial previews On the free trial, each locked hub will show a preview of what it checks.
- Copy-paste fix instructions Priority fixes will include step-by-step instructions you can copy into a ticket or change request.
2027
- NIST, NCSC and CIS Intune mapping Checks will show the matching controls in the NIST Cybersecurity Framework, the NCSC Cloud Security Principles and the CIS Microsoft Intune Benchmark.
- Defender for Endpoint report A new report on your devices' vulnerabilities, installed software, security recommendations and exposure score.
- Defender alerts and attack simulation Checks for open Microsoft Defender alerts, and for whether you run attack simulation training.
- SharePoint sharing defaults Checks on the default sharing link type and permission, and on expiry for "Anyone" links and guest access.
- PDF export Download your health report as a PDF to share with your board, auditors or insurer.
- Compare refreshes Pick two dates and see which checks improved and which got worse.
- Framework views See your results arranged by framework, such as CIS or Cyber Essentials, with the gaps against each control.
- Licence savings estimates The licensing reports will show what unused and duplicate licences cost you each month.
Suggest something
Sign in to tell Planet IT what you would like Orbit to check or show next.
Sign inTerms of service
Last updated: 3 November 2026
These terms are the agreement between Planet IT of Milton Park, Oxfordshire, United Kingdom (“Planet IT”, “we”, “us”) and the organisation using Orbit (“you”). By signing in to Orbit, or by consenting to its access to your Microsoft 365 tenant, you accept these terms on behalf of your organisation and confirm you have the authority to do so. If you do not agree to these terms, do not use the service.
1. The service
Orbit is a reporting service that reads your Microsoft 365 tenant's configuration through Microsoft Graph permissions that can't change it (section 3 lists them) and scores it against Microsoft's recommended configuration (the Scoring tab describes how). Its output is guidance to act on. It is not a security certification, a compliance audit, legal advice or a guarantee that your tenant is secure, and you remain responsible for every decision and change you make in your own tenant.
Orbit depends on Microsoft's APIs, which we don't control, and is provided without an uptime guarantee. When a data source can't be read, your reports say so rather than guessing. We may change or improve the service — including its checks and scoring — at any time, which can change your scores without anything changing in your tenant.
2. Accounts and acceptable use
Sign-in uses your organisation's own Microsoft work or school accounts; Orbit holds no credentials for them. Your Global Administrators can always sign in, and they decide who else can on the Users list on Orbit's Account page. Any other account is rejected at sign-in, and removing someone's access ends their session within ten minutes.
- Only your own tenants. You may only connect Microsoft 365 tenants you are authorised to administer.
- Internal use. Your reports are for use within your organisation and by advisors working on its behalf. You may not resell the service or offer it to third parties as your own.
- No interference. You may not attempt to bypass access controls, probe or disrupt the service, or use it in breach of applicable law or of Microsoft's own terms for your tenant.
3. Access to your tenant
This section is the canonical statement of Orbit's access: what it can read, how that's granted and how to revoke it.
- Read-only by default. Every permission in Orbit's sign-up consent is a read-only Microsoft Graph or Microsoft Defender scope. Nothing in that consent can change any setting, policy, user or data in your tenant — Microsoft enforces this at the token level, not Orbit's code.
- Optional grants, made and removed by you. A few
reports need more than the sign-up consent. Those permissions are
never part of it: each exists only as a grant your own Global
Administrator creates when you turn the feature on, and removes the
same way — inside Orbit, or in Microsoft Entra under
Enterprise applications → Orbit →
Permissions. They are
Sites.Read.All(the Copilot readiness site scan),MailboxSettings.Read(the mailbox forwarding-rules sweep) andConfigurationMonitoring.ReadWrite.All— the one permission Orbit can hold that isn't a plain read: it asks Microsoft's Tenant Configuration Management service to take a configuration snapshot and deletes Orbit's own finished snapshot jobs, and it can't change any setting either. - Public DNS. Orbit also reads public DNS, which needs no permission at all: your domains' published SPF, DKIM and DMARC records, and whether the domains in your apps' sign-in redirect addresses still exist.
- Tenant Configuration Management (optional, per report). Microsoft offers no direct way for an app to read Exchange Online, Defender for Office 365 or Teams meeting policies. The Mail Security and Meeting Safety reports therefore use Microsoft's Tenant Configuration Management service, which your administrator authorises once. The report's setup panel gives the steps. Those steps grant read-only roles (Exchange.ManageAsApp, Organization.Read.All, Security Reader and Global Reader, plus Exchange Online's View-Only Configuration and Security Reader roles) to Microsoft's own service principal in your tenant, not to Orbit. Microsoft's service reads the configuration inside your tenant, and Orbit collects the snapshot through the optional snapshot grant above. Microsoft keeps each snapshot job for up to seven days; Orbit deletes its own once read. To stop it, delete the Unified Tenant Configuration Management enterprise application; the rest of Orbit is unaffected.
- Partner access reporting. If Planet IT is also your Microsoft partner, the Guests report lists the partner-access (GDAP) relationships Planet IT holds with your tenant. Microsoft only lets a partner read these from the partner's side, so Orbit reads them from Planet IT's own tenant. Nothing extra is granted in yours.
- Consent granted once, revocable at any time. A Global Administrator consents during onboarding; that standing consent is what lets Orbit read the tenant on each health check without asking again — Orbit holds no credentials for your tenant, and every read uses a token Microsoft issues against that consent. To revoke it: Microsoft Entra admin centre → Enterprise applications → Orbit → Delete. Access stops immediately. You don't need to contact Planet IT.
The sign-up consent. Each scope is the least-privileged permission for the reports it feeds, and every one is read-only. Some newer reports, such as Privileged Identity Management and access reviews, need a permission your tenant may not have granted yet. Until it is, those checks simply don't appear; nothing fails and nothing is scored against you. Some also need an Entra ID P2 licence.
| Permission | Access | What it's used for |
|---|---|---|
AccessReview.Read.All |
Read-only | Check whether access reviews are configured. |
Alert.Read.All |
Read-only | Microsoft Defender for Endpoint: read security alert summaries. |
Application.Read.All |
Read-only | Read app registrations: credentials (expired or long-lived secrets), redirect URIs, owners and the permissions apps hold. |
AttackSimulation.Read.All |
Read-only | Read attack simulation and training activity. |
AuditLog.Read.All |
Read-only | Read sign-in activity and authentication-method registration to flag inactive accounts and MFA gaps. Read the directory audit log to show who made a configuration change. |
ConfigurationMonitoring.Read.All |
Read-only | Read configuration snapshots from Microsoft's Tenant Configuration Management service. This is the only way to read Exchange Online, Defender for Office 365 and Teams meeting policies. |
DeviceManagementApps.Read.All |
Read-only | Read Intune mobile application protection (MAM) policies, and the Intune audit log to show who changed a policy. |
DeviceManagementConfiguration.Read.All |
Read-only | Read Intune configuration profiles, compliance policies, security baselines, endpoint security policies and update policies. Read their assignments and settings-catalog values to find policies that conflict. |
DeviceManagementManagedDevices.Read.All |
Read-only | Read Intune-managed device inventory, compliance, sync and encryption state. |
DeviceManagementServiceConfig.Read.All |
Read-only | Read Intune enrollment configuration and the health of the Apple push certificate, Apple VPP and enrollment tokens and Managed Google Play. |
Directory.Read.All |
Read-only | Resolve user, group and role names, and read directory settings such as password protection and consent configuration. |
IdentityUserFlow.Read.All |
Read-only | Read self-service sign-up user flows for external users. |
Machine.Read.All |
Read-only | Microsoft Defender for Endpoint: read device protection status. |
Organization.Read.All |
Read-only | Read your organisation's display name and hybrid (on-premises sync) status. |
Policy.Read.All |
Read-only | Read Conditional Access policies and named locations, authentication methods, consent and app-management policies, and cross-tenant access defaults. |
Reports.Read.All |
Read-only | Read Microsoft 365 usage reports (Teams and SharePoint site activity, Exchange mailbox usage and Copilot usage) to flag dormant and externally-shared content. |
RoleManagement.Read.Directory |
Read-only | Read Privileged Identity Management (PIM): eligible versus permanent admin role assignments and whether Global Administrator activation needs approval. |
RoleManagementAlert.Read.Directory |
Read-only | Read Privileged Identity Management's own security alerts. |
Score.Read.All |
Read-only | Microsoft Defender for Endpoint: read exposure and device scores. |
SecurityAlert.Read.All |
Read-only | Read security alert summaries across Microsoft Defender. |
SecurityConfiguration.Read.All |
Read-only | Microsoft Defender for Endpoint: read device security configuration assessments. |
SecurityRecommendation.Read.All |
Read-only | Microsoft Defender for Endpoint: read security recommendations. |
SensitivityLabels.Read.All |
Read-only | Read the tenant's Microsoft Purview sensitivity labels to check content classification is in place. |
SharePointTenantSettings.Read.All |
Read-only | Read the tenant's SharePoint and OneDrive settings: external sharing, device sync and session controls. |
Software.Read.All |
Read-only | Microsoft Defender for Endpoint: read device software inventory. |
Vulnerability.Read.All |
Read-only | Microsoft Defender for Endpoint: read device vulnerability information. |
Optional grants. These aren't part of the sign-up consent at all — each exists only in tenants whose Global Administrator turned that feature on, and is removed the same way: inside Orbit, or in Microsoft Entra under Enterprise applications → Orbit → Permissions.
| Permission | Access | What it's used for |
|---|---|---|
ConfigurationMonitoring.ReadWrite.All |
Optional grant | Ask Tenant Configuration Management to take a configuration snapshot each night, and delete Orbit's own finished snapshot jobs. This permission creates and deletes snapshot jobs only. It cannot change any setting in your tenant. You grant it in the Mail Security setup when you connect that report, never at sign-up. |
MailboxSettings.Read |
Optional grant | Read each mailbox's inbox rules to find rules that forward mail outside the organisation or hide warnings. The Mail Security setup script grants it. |
Sites.Read.All |
Optional grant | Read each site's sharing links and direct grants for the Copilot readiness site scan. You grant it in the readiness report when you enable the site scan, and you revoke it there when you finish. |
4. Trials, subscriptions and billing
The free trial includes your overall tenant health score and the full Entra ID hub. Full access comes with a subscription: agreed directly with Planet IT, purchased through Microsoft Marketplace — where Microsoft bills you under its own commercial terms and handles refunds and cancellation — or included in a wider agreement with Planet IT, such as a licensing or managed-service package. Whichever way you subscribe, these terms govern your use of Orbit. Fees are as agreed or listed at the time of purchase, exclusive of VAT unless stated otherwise.
A subscription agreed directly with Planet IT runs for a year at a time; we'll contact you before it ends to renew. If it isn't renewed, your organisation returns to the free trial the day after it ends, and your Global Administrators are emailed to say so. A Planet IT voucher code, redeemed by a Global Administrator on the Account page, gives full access until the date the voucher states, then returns your organisation to the free trial in the same way. Nothing is billed for a voucher. Where Orbit is included in a wider agreement with Planet IT, full access runs for as long as that agreement does, nothing is billed for Orbit separately, and your organisation returns to the free trial when the agreement ends — again with an email to your Global Administrators. Marketplace subscriptions renew and end only as Microsoft manages them. The free trial itself doesn't expire.
If a subscription lapses or isn't paid, we may suspend full access until it's resolved; your data-deletion rights in section 5 are unaffected. You can cancel in line with your subscription agreement, or in Microsoft Marketplace if that's where you bought it.
5. Your data and privacy
This section is the Orbit data-handling statement: exactly what Orbit stores about your organisation, why, for how long, where it lives, who can see it and how to have it deleted. It's written to be handed to a security review or kept in your data-protection records, and it forms part of these terms. We process your tenant's data to provide the service and to support and advise your organisation on it and on related Planet IT services, in accordance with UK data protection law.
Exactly what Orbit keeps
This table lists everything Orbit keeps. Orbit stores no data about a tenant until its administrator has consented and signed in. The one exception is the event log, which records every sign-in attempt, including refused ones.
| What | Exactly what's kept | Why & how long |
|---|---|---|
| Access record | Your sign-in domain, Microsoft tenant ID, plan status (trial, active or suspended) with its start and end dates, any voucher code redeemed (and the email address of the Global Administrator who redeemed it), and first- and last-sign-in timestamps. No configuration. | Identifies who may use Orbit and manages your trial or subscription. Kept after your service ends, so a closed account can't start a new free trial. It is the one record a deletion request leaves in place. |
| Daily score history | One row per day of your score numbers, recorded by the nightly refresh: the per-hub scores, the overall (e.g. “Intune: 74”) and your licensed-user count. Never the findings, settings or configuration behind them. | Draws the trend on the History page and shows Planet IT your latest overall health score. Kept for a rolling 90 days. Older rows are deleted automatically every night. Deleted sooner if you ask. |
| Report snapshots | The configuration and usage data behind your reports, exactly as read: policies, settings, device inventory, licence and usage reports, and the user, group and app details your reports list. Where you've connected Tenant Configuration Management, it also includes the Exchange, Defender and Teams policy settings from Microsoft's snapshot, plus the DNS results Orbit looked up. | Serves your reports at sign-in instead of re-querying Microsoft each time. Orbit refreshes it automatically every night (around 01:00 UK time); signing in never re-reads your tenant. The Refresh button reads your tenant live and replaces the snapshot. Orbit deletes a snapshot 30 days after its last refresh, or immediately if your service is suspended or you leave. |
| Configuration change log | A short record of what changed between one refresh and the next: the kind of object (say, a Conditional Access policy), its name and which fields changed. Where your own audit log shows it, also the administrator who made the change. Never the settings' values themselves, and never user, device or usage data beyond that one name. | Fills the “Configuration changes” list on the History page, so you can see changes to your tenant's security configuration over time. Kept for a rolling 90 days, and deleted immediately if your service is suspended or you leave. |
| Your Orbit users | The email addresses your Global Administrators add. For each address: whether it may sign in to Orbit, whether it receives the monthly email (your score plus a “what's new in Microsoft 365” newsletter), when it was added, when it last visited, and whether it last signed in as a Global Administrator. A Global Administrator is added automatically on first sign-in. | Decides who can sign in and sends that one email to the right people. Managed by your Global Administrators on the Account page, where any address can be switched off or removed outright, and deleted with the rest of your data. |
| Event log | A record of what Orbit did and for whom. Sign-ins and refused sign-ins: the email address, tenant ID, IP address and browser (User-Agent) of the person, and the reason for any refusal. Sign-outs. Refresh and nightly refreshes: which reports succeeded, plus Microsoft's error code and the API endpoint when a read fails. Changes to your Orbit users. Delivery of the monthly email to each recipient. Planet IT operator actions. Errors, with a reference number. Never your configuration, report content, tokens or passwords. | Lets Planet IT troubleshoot sign-in and data problems and audit operator access. Visible only to Planet IT's Orbit operators, never in the product's customer pages. Kept for a rolling 90 days — older entries are deleted automatically every night. |
| Account summary | A high-level summary of your Microsoft 365 subscriptions and the security and backup tools in use in your tenant, drawn from the same read-only access as your reports. | Helps Planet IT support and advise your organisation. Visible only to Planet IT's Orbit operators; refreshed periodically and deleted with the rest of your data. |
| Roadmap feedback | Feedback you send from the Roadmap tab: what you wrote, your name, email address, tenant ID and organisation domain, and when you sent it. | Tells Planet IT what to build next, and lets us reply to you. Visible only to Planet IT's Orbit operators. Kept indefinitely, including after a deletion request. To have it deleted, email orbit@planet-it.net. |
| Nothing else | Never stored: passwords, credentials or security tokens; email, file or chat content; anything Orbit's permissions cannot see. | See the permissions table in section 3 for the full scope list. |
Where it lives and who can see it
All of it lives in Planet IT's Azure Storage account in the UK South region, encrypted at rest by Azure Storage encryption and in transit with TLS. It is stored under your Microsoft tenant ID and shown only to your own organisation's signed-in administrators. One tenant can never read another's data. Within Planet IT, access is limited to the named operators who run Orbit. For support, one of them can open a read-only view of your Orbit dashboard. It shows every report, including any your plan doesn't include, but only from the data stored here. It never reads your tenant live and it writes nothing. Each use is recorded in the event log. Microsoft Azure is the hosting provider. We do not share stored data with, or sell it to, anyone else. We make no automated decisions about individuals from it.
Your browser also holds a session copy of report content and score numbers (a signed cookie plus session storage) so pages don't re-fetch as you navigate; it expires with your session.
Deletion, in your own hands
Any of your administrators can delete everything Orbit stores about your tenant, without asking us. Sign in, open Account in the top bar, and use Delete everything Orbit stores. This removes your report snapshots, score history, configuration change log and user list in one step. Only the access record, any roadmap feedback and the event log described above remain. The event log is the audit trail: it records the deletion and is itself deleted after 90 days. If you prefer, email us (orbit@planet-it.net) and we will do the same thing.
Deleting your data ends your Orbit service. Orbit suspends your tenant at the same moment. Otherwise the next sign-in would read everything again and undo the deletion. Tell us when you'd like to start again. Billing is separate: if Microsoft bills you through Marketplace, cancel the subscription there too.
6. Intellectual property
Orbit — its software, checks, scoring model and report designs — belongs to Planet IT. Your subscription gives your organisation a non-exclusive, non-transferable right to use the service and its reports for as long as you're subscribed, and nothing more. Your tenant's configuration and data remain yours; these terms give us no rights over them beyond what's needed to provide the service. Microsoft, Microsoft 365 and related marks are Microsoft's trademarks; Orbit is built by Planet IT and is not a Microsoft product.
7. Warranties
The service is provided “as is”. To the fullest extent permitted by law we exclude all implied warranties, including fitness for a particular purpose, and we don't warrant that reports are complete or error-free — validate changes before making them in your tenant.
8. Suspension and termination
We may suspend or end your access if you materially breach these terms, if your use creates a security risk, or if a subscription lapses (section 4). You may stop using Orbit at any time by revoking consent in Microsoft Entra and, if you wish, deleting your stored data as described in section 5. Sections 5–7 and 9–10 survive termination.
9. Changes to these terms
We may update these terms from time to time; the date at the top is always the current version's. If a change is material we'll flag it in the service before it takes effect. Continuing to use Orbit after a change takes effect means you accept the updated terms.
10. Governing law and contact
These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising from them. Questions about these terms: orbit@planet-it.net.
Planet IT is an outsourced IT provider based at Milton Park, Oxfordshire. More than fifty engineers and developers support organisations across the UK and Europe, with 24-hour cover.
Planet IT builds and runs Orbit. Its checks use the Microsoft configuration standards that Planet IT's engineers apply in customer tenants.
- Accreditations. ISO 27001 certified, Cyber Essentials Plus assessed, and ranked a Best Company 2025.
- Microsoft Solutions Partner. Designations for Security, AI Business Solutions and Infrastructure (Azure).
- Services. Managed and co-managed IT support, security, backup and disaster recovery, cloud infrastructure, professional services and automation.
Contact us
Orbit support
Questions about Orbit itself — your scores and checks, the data behind them, access and sign-in, or anything not working as it should.
orbit@planet-it.netManaged IT & projects
Managed and co-managed support, projects, migrations, licensing and general enquiries — the whole Planet IT service desk and commercial team.
enquiries@planet-it.netModern Work
Modern Work deployments, readiness checks and adoption. Goes straight to our Modern Work lead, for anything your Modern Work readiness page shows.
lewis.kitchen@planet-it.net