Rule explorer
Browse every hardening rule in the catalogue. Filter by platform, severity, profile level and whether the check can be automated.
176 rules foundof 8,597Page 1 of 8
| ID | Title | Platform | Severity | Level | Check |
|---|---|---|---|---|---|
| TMA-M365-ADMIN-MFA | Ensure multifactor authentication is required for administrative rolesm365 · Level 1 | m365 | Critical | 1 | Automated |
| TMA-M365-LEGACY-AUTH-BLOCKED | Ensure legacy authentication is blockedm365 · Level 1 | m365 | Critical | 1 | Automated |
| TMA-M365-SECURITY-DEFAULTS-CA | Ensure security defaults or Conditional Access policies are enforcedm365 · Level 1 | m365 | Critical | 1 | Automated |
| TMA-M365-1.1.2 | Ensure two emergency access accounts have been definedm365 · Level 1 | m365 | High | 1 | Manual review |
| TMA-M365-2.1.12 | Ensure the connection filter IP allow list is not usedm365 · Level 1 | m365 | High | 1 | Manual review |
| TMA-M365-2.1.13 | Ensure the connection filter safe list is offm365 · Level 1 | m365 | High | 1 | Manual review |
| TMA-M365-2.1.15 | Ensure outbound anti-spam message limits are in placem365 · Level 1 | m365 | High | 1 | Manual review |
| TMA-M365-3.2.3 | Ensure DLP policies are published for Copilot usersm365 · Level 1 | m365 | High | 1 | Manual review |
| TMA-M365-4.1 | Ensure devices without a compliance policy are marked 'not compliant'm365 · Level 1 | m365 | High | 1 | Manual review |
| TMA-M365-5.1.2.1 | Ensure 'Per-user MFA' is disabledm365 · Level 1 | m365 | High | 1 | Manual review |
| TMA-M365-5.1.5.4 | Ensure password lifetime for applications does not exceed 180 daysm365 · Level 1 | m365 | High | 1 | Manual review |
| TMA-M365-5.1.5.5 | Ensure new application passwords are system-generatedm365 · Level 1 | m365 | High | 1 | Manual review |
| TMA-M365-5.1.5.6 | Ensure maximum certificate lifetime for applications does not exceed 180 daysm365 · Level 1 | m365 | High | 1 | Manual review |
| TMA-M365-5.1.6.2 | Ensure that guest user access is restrictedm365 · Level 1 | m365 | High | 1 | Manual review |
| TMA-M365-5.2.2.1 | Ensure multifactor authentication is enabled for all users in administrative rolesm365 · Level 1 | m365 | High | 1 | Manual review |
| TMA-M365-5.2.2.2 | Ensure multifactor authentication is enabled for all usersm365 · Level 1 | m365 | High | 1 | Manual review |
| TMA-M365-5.2.2.3 | Enable Conditional Access policies to block legacy authenticationm365 · Level 1 | m365 | High | 1 | Manual review |
| TMA-M365-5.2.2.4 | Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative usersm365 · Level 1 | m365 | High | 1 | Manual review |
| TMA-M365-5.2.2.9 | Ensure a managed device is required for authenticationm365 · Level 1 | m365 | High | 1 | Manual review |
| TMA-M365-5.2.2.10 | Ensure a managed device is required to register security informationm365 · Level 1 | m365 | High | 1 | Manual review |
| TMA-M365-5.2.2.11 | Ensure sign-in frequency for Intune Enrollment is set to 'Every time'm365 · Level 1 | m365 | High | 1 | Manual review |
| TMA-M365-5.2.2.13 | Ensure that periodic reauthentication is required for all usersm365 · Level 1 | m365 | High | 1 | Manual review |
| TMA-M365-5.2.3.1 | Ensure Microsoft Authenticator is configured to protect against MFA fatiguem365 · Level 1 | m365 | High | 1 | Manual review |
| TMA-M365-5.2.3.2 | Ensure custom banned passwords lists are usedm365 · Level 1 | m365 | High | 1 | Manual review |
| TMA-M365-5.2.3.4 | Ensure all member users are 'MFA capable'm365 · Level 1 | m365 | High | 1 | Manual review |