The searchable 53-control catalog for Microsoft 365.
The search and filters are directly below this introduction. Each control shows its objective, mapping and testing boundary.
53 of 53 controls visible
Version 0.18.0: 17 automatic, 24 partially automatic and 12 manual-evidence controls. These modes describe the current implementation, not a guaranteed coverage level in every tenant.
Identities and privileged access
IAM-01Admin MFA and authentication strengthAutomatic
Assessment objective
The current version evaluates available technical evidence for Admin MFA and authentication strength. Licences, permissions and API availability determine the resulting coverage.
Mapping
BSIG §30 Abs. 2 Nr. 9–10 · BSI ORP.4
Testability
The available technical configuration is evaluated automatically; licences, permissions and API availability determine coverage.
IAM-02MFA coverage for all usersAutomatic
Assessment objective
The current version evaluates available technical evidence for MFA coverage for all users. Licences, permissions and API availability determine the resulting coverage.
Mapping
BSIG Nr. 9–10 · BSI ORP.4
Testability
The available technical configuration is evaluated automatically; licences, permissions and API availability determine coverage.
IAM-03Legacy authentication blockedAutomatic
Assessment objective
The current version evaluates available technical evidence for Legacy authentication blocked. Licences, permissions and API availability determine the resulting coverage.
Mapping
BSIG Nr. 5, 9–10 · BSI ORP.4/APP.5.2
Testability
The available technical configuration is evaluated automatically; licences, permissions and API availability determine coverage.
IAM-04Conditional Access inventoryPartially automatic
Assessment objective
Collects enabled, disabled and report-only Conditional Access policies. Inventory counts do not prove gap-free coverage across users, resources and access scenarios.
Mapping
BSIG Nr. 1, 5, 9–10 · BSI ORP.4
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
IAM-05Protection of admin portalsAutomatic
Assessment objective
The current version evaluates available technical evidence for Protection of admin portals. Licences, permissions and API availability determine the resulting coverage.
Mapping
BSIG Nr. 9–10 · BSI ORP.4
Testability
The available technical configuration is evaluated automatically; licences, permissions and API availability determine coverage.
IAM-06Privileged roles and least privilegePartially automatic
Assessment objective
Inventories privileged role assignments and multiple-role holders. Business justification and least-privilege suitability still require professional review.
Mapping
BSIG Nr. 9 · BSI ORP.4
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
IAM-07Privileged Identity ManagementPartially automatic, licence-dependent
Assessment objective
Collects eligible role assignments. Activation rules, approval, MFA, duration and expiry require additional PIM policy data.
Mapping
BSIG Nr. 5, 9–10 · BSI ORP.4
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
IAM-08Emergency access accountsPartially automatic
Assessment objective
The current version collects available technical indicators for Emergency access accounts; completeness, suitability or effectiveness requires professional review.
Mapping
BSIG Nr. 2–3, 9–10 · BSI ORP.4/DER
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
IAM-09Risky usersPartially automatic, licence-dependent
Assessment objective
Checks unresolved risky-user cases. Risky sign-ins and complete risk-based policy coverage are outside this control.
Mapping
BSIG Nr. 1–2, 6 · BSI DER.1/OPS.1.1.5
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
IAM-10Authentication methodsAutomatic
Assessment objective
The current version evaluates available technical evidence for Authentication methods. Licences, permissions and API availability determine the resulting coverage.
Mapping
BSIG Nr. 5, 9–10 · BSI ORP.4
Testability
The available technical configuration is evaluated automatically; licences, permissions and API availability determine coverage.
IAM-11Password protection and SSPRPartially automatic
Assessment objective
The current version collects available technical indicators for Password protection and SSPR; completeness, suitability or effectiveness requires professional review.
Mapping
BSIG Nr. 5, 7, 9 · BSI ORP.4
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
IAM-12Service and workload identitiesPartially automatic
Assessment objective
The current version collects available technical indicators for Service and workload identities; completeness, suitability or effectiveness requires professional review.
Mapping
BSIG Nr. 4–5, 9 · BSI ORP.4/OPS.2.2
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
Apps, OAuth and supply chain
APP-01User and admin consentAutomatic
Assessment objective
The current version evaluates available technical evidence for User and admin consent. Licences, permissions and API availability determine the resulting coverage.
Mapping
BSIG Nr. 4–5, 9 · BSI OPS.2.2/ORP.4
Testability
The available technical configuration is evaluated automatically; licences, permissions and API availability determine coverage.
APP-02Highly privileged app permissionsAutomatic
Assessment objective
The current version evaluates available technical evidence for Highly privileged app permissions. Licences, permissions and API availability determine the resulting coverage.
Mapping
BSIG Nr. 4–5, 9 · BSI OPS.2.2
Testability
The available technical configuration is evaluated automatically; licences, permissions and API availability determine coverage.
APP-03App credentials, certificates and ownersAutomatic
Assessment objective
Finds expiring, expired or unusually long-lived credentials and applications without owners.
Mapping
BSIG Nr. 4–5 · BSI OPS.2.2
Testability
The available technical configuration is evaluated automatically; licences, permissions and API availability determine coverage.
APP-04Workload identity Conditional AccessManual evidence, licence-dependent
Assessment objective
Requires joint professional review of workload-identity risk and relevant Conditional Access policies; it is not conclusively automated.
Mapping
BSIG Nr. 4–5, 9–10 · BSI OPS.2.2
Testability
The current version requires documented manual evidence and does not produce a conclusive automated result for this control.
APP-05Publisher verification metadataAutomatic
Assessment objective
Finds application service principals without verified publisher metadata. Verification metadata is not a complete application risk assessment.
Mapping
BSIG Nr. 4–6 · BSI OPS.2.2
Testability
The available technical configuration is evaluated automatically; licences, permissions and API availability determine coverage.
APP-06Cross-tenant accessPartially automatic
Assessment objective
Collects the cross-tenant default policy. Partner-specific rules and acceptable trust relationships require professional review.
Mapping
BSIG Nr. 4, 9–10 · BSI OPS.2.2/ORP.4
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
User, guest and group lifecycle
EXT-01Inactive and orphaned usersAutomatic
Assessment objective
The current version evaluates available technical evidence for Inactive and orphaned users. Licences, permissions and API availability determine the resulting coverage.
Mapping
BSIG Nr. 5, 9 · BSI ORP.4
Testability
The available technical configuration is evaluated automatically; licences, permissions and API availability determine coverage.
EXT-02Inactive guest usersPartially automatic, partly licence-dependent
Assessment objective
Finds inactive guest accounts. Sponsors, actual resource access and Access Reviews require additional data.
Mapping
BSIG Nr. 4, 6, 9 · BSI ORP.4/OPS.2.2
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
EXT-03Direct privileged guest rolesPartially automatic
Assessment objective
Checks whether guest accounts are directly assigned to directory roles. Transitive and resource-specific permissions are not fully covered.
Mapping
BSIG Nr. 4, 9 · BSI ORP.4
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
EXT-04Ownerless Microsoft 365 groupsAutomatic
Assessment objective
Finds Microsoft 365 groups without owners after the owner query succeeds. Standalone SharePoint sites are not included.
Mapping
BSIG Nr. 5, 9 · BSI ORP.4
Testability
The available technical configuration is evaluated automatically; licences, permissions and API availability determine coverage.
EXT-05Joiner, mover and leaver evidencePartially automatic
Assessment objective
The current version collects available technical indicators for Joiner, mover and leaver evidence; completeness, suitability or effectiveness requires professional review.
Mapping
BSIG Nr. 7, 9 · BSI ORP.2/ORP.4
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
Devices and endpoint protection
DEV-01Compliant devices for sensitive accessAutomatic
Assessment objective
The current version evaluates available technical evidence for Compliant devices for sensitive access. Licences, permissions and API availability determine the resulting coverage.
Mapping
BSIG Nr. 5, 9–10 · BSI SYS.3.2/ORP.4
Testability
The available technical configuration is evaluated automatically; licences, permissions and API availability determine coverage.
DEV-02Intune compliancePartially automatic, licence-dependent
Assessment objective
Evaluates Intune-reported device compliance and available policies. Complete assignment and platform coverage requires additional review.
Mapping
BSIG Nr. 5–6, 9 · BSI SYS.3.2
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
DEV-03Mobile app protectionPartially automatic, licence-dependent
Assessment objective
Collects mobile application management and app-protection policies. Assignments and individual protection settings are not fully evaluated.
Mapping
BSIG Nr. 5, 8–9 · BSI SYS.3.2
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
DEV-04Reported device encryptionAutomatic, if reported
Assessment objective
Evaluates the encryption state reported by Intune. Secure Boot is not part of this control.
Mapping
BSIG Nr. 5, 8–9 · BSI SYS.2.1/SYS.3.2
Testability
The available technical configuration is evaluated automatically; licences, permissions and API availability determine coverage.
DEV-05Operating system and patch levelPartially automatic
Assessment objective
The current version collects available technical indicators for Operating system and patch level; completeness, suitability or effectiveness requires professional review.
Mapping
BSIG Nr. 5–6 · BSI OPS.1.1.3/SYS
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
DEV-06Defender for Endpoint integrationManual evidence, licence-dependent
Assessment objective
Requires Defender evidence for device onboarding, risk signals and Conditional Access integration; it is not conclusively automated.
Mapping
BSIG Nr. 1–2, 5–6 · BSI DER.1
Testability
The current version requires documented manual evidence and does not produce a conclusive automated result for this control.
Email, Teams, SharePoint and OneDrive
MAIL-01SPF, DKIM and DMARCPartially automatic
Assessment objective
The current version collects available technical indicators for SPF, DKIM and DMARC; completeness, suitability or effectiveness requires professional review.
Mapping
BSIG Nr. 5, 7 · BSI APP.5.2
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
MAIL-02Anti-phishing and identity protectionPartially automatic, licence-dependent
Assessment objective
Collects enabled anti-phishing policies and spoof intelligence. Rule assignment and full target coverage require additional review.
Mapping
BSIG Nr. 1–2, 5 · BSI APP.5.2
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
MAIL-03Safe Links and Safe AttachmentsPartially automatic, licence-dependent
Assessment objective
Collects Safe Links and Safe Attachments policies. Targets, exceptions and dynamic delivery require additional review.
Mapping
BSIG Nr. 1–2, 5 · BSI APP.5.2
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
MAIL-04External automatic forwardingAutomatic
Assessment objective
The current version evaluates available technical evidence for External automatic forwarding. Licences, permissions and API availability determine the resulting coverage.
Mapping
BSIG Nr. 5, 8–9 · BSI APP.5.2
Testability
The available technical configuration is evaluated automatically; licences, permissions and API availability determine coverage.
MAIL-05SMTP AUTH and legacy protocolsAutomatic
Assessment objective
The current version evaluates available technical evidence for SMTP AUTH and legacy protocols. Licences, permissions and API availability determine the resulting coverage.
Mapping
BSIG Nr. 5, 9–10 · BSI APP.5.2/ORP.4
Testability
The available technical configuration is evaluated automatically; licences, permissions and API availability determine coverage.
MAIL-06Audit ingestion enabledAutomatic
Assessment objective
Checks organisation-wide audit and Unified Audit switches. Captured actions and retention periods are assessed separately.
Mapping
BSIG Nr. 2, 6 · BSI OPS.1.1.5
Testability
The available technical configuration is evaluated automatically; licences, permissions and API availability determine coverage.
COL-01SharePoint and OneDrive sharingManual evidence
Assessment objective
Requires SharePoint Online data and business-context review; it is a manual-evidence control in the current version.
Mapping
BSIG Nr. 4–5, 8–9 · BSI OPS.2.2
Testability
The current version requires documented manual evidence and does not produce a conclusive automated result for this control.
COL-02Unmanaged device accessManual evidence
Assessment objective
Requires joint review of SharePoint settings and Conditional Access policies; it is a manual-evidence control in the current version.
Mapping
BSIG Nr. 5, 8–10 · BSI SYS.3.2/OPS.2.2
Testability
The current version requires documented manual evidence and does not produce a conclusive automated result for this control.
COL-03Teams guest and external accessPartially automatic
Assessment objective
Collects Teams federation configuration. Approved domains and guest capabilities require professional review.
Mapping
BSIG Nr. 4–5, 9–10 · BSI OPS.2.2
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
COL-04Teams meeting securityPartially automatic
Assessment objective
Collects Teams meeting policies. Assignments and organisation-appropriate settings require professional review.
Mapping
BSIG Nr. 5, 8–10 · BSI OPS.2.2
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
Data protection, classification and retention
DATA-01Unified Audit and retentionManual evidence, licence-dependent
Assessment objective
Requires Purview and Exchange roles, licensing information and evidence of the required retention period.
Mapping
BSIG Nr. 2, 6 · BSI OPS.1.1.5
Testability
The current version requires documented manual evidence and does not produce a conclusive automated result for this control.
DATA-02Data Loss PreventionManual evidence, licence-dependent
Assessment objective
Requires Purview DLP policy collection followed by a professional review of business coverage.
Mapping
BSIG Nr. 5, 8–9 · BSI CON.2/OPS.2.2
Testability
The current version requires documented manual evidence and does not produce a conclusive automated result for this control.
DATA-03Sensitivity labelsManual evidence, licence-dependent
Assessment objective
Requires Purview sensitivity labels, publishing policies and assignment evidence.
Mapping
BSIG Nr. 5, 8–9 · BSI CON.2
Testability
The current version requires documented manual evidence and does not produce a conclusive automated result for this control.
DATA-04Retention and records managementManual evidence
Assessment objective
Requires comparison of technical retention data with business and legal retention requirements.
Mapping
BSIG Nr. 3, 5, 8 · BSI CON.2
Testability
The current version requires documented manual evidence and does not produce a conclusive automated result for this control.
DATA-05eDiscovery and compliance rolesManual evidence
Assessment objective
Requires Purview and eDiscovery role data plus a professional segregation-of-duties review.
Mapping
BSIG Nr. 6, 9 · BSI ORP.4
Testability
The current version requires documented manual evidence and does not produce a conclusive automated result for this control.
Detection, response and resilience
DET-01Security alertsAutomatic, licence-dependent
Assessment objective
Checks open high- and critical-severity security alerts. Complete incident coverage and operational handling require additional evidence.
Mapping
BSIG Nr. 2, 6 · BSI DER.1
Testability
The available technical configuration is evaluated automatically; licences, permissions and API availability determine coverage.
DET-02Log retention and SIEM exportPartially automatic
Assessment objective
The current version collects available technical indicators for Log retention and SIEM export; completeness, suitability or effectiveness requires professional review.
Mapping
BSIG Nr. 2, 6 · BSI OPS.1.1.5
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
DET-03Alerts for privileged changesPartially automatic
Assessment objective
The current version collects available technical indicators for Alerts for privileged changes; completeness, suitability or effectiveness requires professional review.
Mapping
BSIG Nr. 2, 6, 9 · BSI DER.1/OPS.1.1.5
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
DET-04Service health and admin communicationsPartially automatic
Assessment objective
The current version collects available technical indicators for Service health and admin communications; completeness, suitability or effectiveness requires professional review.
Mapping
BSIG Nr. 2–3, 10 · BSI DER.4
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
RES-01Backup, restore and recovery conceptManual evidence
Assessment objective
The current version requires documented manual evidence for Backup, restore and recovery concept and does not produce a conclusive automated result for this control.
Mapping
BSIG Nr. 3 · BSI CON.3
Testability
The current version requires documented manual evidence and does not produce a conclusive automated result for this control.
RES-02Incident and notification processManual evidence
Assessment objective
The current version requires documented manual evidence for Incident and notification process and does not produce a conclusive automated result for this control.
Mapping
BSIG §32 sowie §30 Nr. 2 · BSI DER.1
Testability
The current version requires documented manual evidence and does not produce a conclusive automated result for this control.
RES-03Effectiveness reviews and remediation trackingPartially automatic
Assessment objective
The current version collects available technical indicators for Effectiveness reviews and remediation tracking; completeness, suitability or effectiveness requires professional review.
Mapping
BSIG Nr. 6 · BSI ISMS/Grundschutz-Check
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
RES-04Training and cyber hygieneManual evidence
Assessment objective
The current version requires documented manual evidence for Training and cyber hygiene and does not produce a conclusive automated result for this control.
Mapping
BSIG Nr. 7 und §38 · BSI ORP.3
Testability
The current version requires documented manual evidence and does not produce a conclusive automated result for this control.
RES-05Supply-chain and provider governancePartially automatic
Assessment objective
The current version collects available technical indicators for Supply-chain and provider governance; completeness, suitability or effectiveness requires professional review.
Mapping
BSIG Nr. 4 · BSI OPS.2.2
Testability
Technical indicators are collected, but completeness, suitability or effectiveness requires professional review.
Compare the three licence plans for consultants, MSPs and larger teams.