IAM — Identity & Access

Identity and access controls. 69 controls in total — 69 automatic, 0 attested.

How to read

Result: ✅ Pass · ⚠️ Warning · ❌ Fail · N/A Not evaluated. Status: Auto = Controlio measures it app-only · Attested = the customer marks it. Lv: L1 basic, L2 advanced.

Control	What it checks	Result criteria	Status
IAM-01 Global Admin count L1	Checks how many accounts hold admin authority. Too many widen the attack surface; too few risk losing access.	✅ 2–4 · ❌ Fewer than 2 or more than 4	Auto
IAM-02 Admin accounts should be cloud-only L1	Checks that admin accounts are not synced from the on-premises directory. If a synced admin account is compromised, the whole environment is at risk.	✅ No admin synced from on-premises · ❌ One or more	Auto
IAM-03 Users with no MFA registration L1	Checks accounts with no multi-step verification (MFA) registration. These are a prime target for phishing.	✅ None (0) · ⚠️ 1–5 users · ❌ More than 5	Auto N/A if data is unavailable
IAM-04 User accounts inactive for 90+ days L1	Checks active accounts that have not signed in for more than 90 days. Unused accounts widen the attack surface.	✅ None (0) · ⚠️ 1–5 accounts · ❌ More than 5	Auto N/A if data is unavailable
IAM-05 Inactive guest accounts L1	Checks external guest accounts unused for a long time. Stale guest accounts carry a data-leakage risk.	✅ None (0) · ⚠️ 1–3 accounts · ❌ More than 3	Auto N/A if data is unavailable
IAM-06 Privileged user count L1	Checks how many accounts have elevated authority. Too many privileged accounts widen the attack surface.	✅ 4 or fewer · ⚠️ 5–8 · ❌ More than 8	Auto
IAM-07 No risky users L1	Checks accounts with a high chance of being compromised (risky). They pose an active threat.	✅ No risky users · ❌ One or more	Auto Requires Entra ID P2; N/A otherwise
IAM-08 Baseline security protections active L1	Checks that at least a baseline access-security protection (Security Defaults or Conditional Access) is on in the tenant. Without it, basic controls are missing.	✅ Security Defaults or at least one Conditional Access policy on · ❌ Neither	Auto
IAM-09 Conditional Access policy count (5+) L1	Checks that there are enough Conditional Access policies. Too few leave security gaps.	✅ 5 or more · ⚠️ 2–4 · ❌ Fewer than 2	Auto Requires Business Premium (Entra P1); N/A otherwise
IAM-10 Privileged access management (PIM) usage L2	Checks that admin roles are granted just in time (with PIM) rather than permanently. Permanent roles are a standing risk.	✅ A just-in-time assigned role exists · ❌ None	Auto Requires Entra ID P2; N/A otherwise
IAM-11 Access review defined L1	Checks that a review is defined so user access is examined regularly. Without it, needless access goes unnoticed.	✅ At least one access review defined · ❌ None	Auto Requires Entra ID P2; N/A otherwise
IAM-12 Named location defined L1	Checks that trusted geographic locations or IP ranges are defined. Without them, location-based restriction is not possible.	✅ At least one named location defined · ⚠️ None	Auto Requires Business Premium (Entra P1); N/A otherwise
IAM-14 Guest invitation authority limited L1	Checks that who can invite external guests is limited. If anyone can invite, a compromised account can bring an attacker into the environment.	✅ Admins and those granted invite rights only · ❌ All users can invite	Auto N/A if data is unavailable
IAM-15 Cross-tenant access control L2	Checks that access with external organization tenants is managed. Uncontrolled access carries a data-sharing risk.	✅ Cross-tenant access settings defined · ⚠️ Not defined	Auto
IAM-16 Device limit per user (at most 20) L1	Checks that the number of devices a user can register is limited. Unlimited registration lets an attacker add their own device.	✅ 20 or fewer · ❌ More than 20 or the setting is unreadable	Auto
IAM-17 MFA required for admin roles L1	Checks that multi-step verification is required on admin roles. Without it, an admin account is easily compromised.	✅ MFA required for admin roles · ❌ Not required	Auto Requires Business Premium (Entra P1); N/A otherwise
IAM-18 Legacy authentication blocked L1	Checks that legacy sign-in protocols are blocked. They can bypass multi-step verification.	✅ Legacy authentication blocked · ❌ Not blocked	Auto Requires Business Premium (Entra P1); N/A otherwise
IAM-19 User risk policy active L1	Checks that a user risk policy is on to automatically detect compromised accounts. Without it, suspicious accounts go unnoticed.	✅ User risk policy active · ❌ Not active	Auto Requires Entra ID P2; N/A otherwise
IAM-20 Sign-in risk policy active L1	Checks that a risk policy is on to automatically detect suspicious sign-in attempts. Without it, risky sign-ins are not blocked.	✅ Sign-in risk policy active · ❌ Not active	Auto Requires Entra ID P2; N/A otherwise
IAM-22 Break-glass account exists L1	Checks that an emergency access account is set aside for exceptional situations. Without one, an admin lockout can lose access entirely.	✅ 2 or more · ⚠️ 1 account · ❌ None	Auto
IAM-23 No permanent Global Admin assignment L1	Checks that the Global Admin role is granted just in time rather than permanently. Permanent assignments are uncontrolled standing access.	✅ At most 2 permanent, and a just-in-time assignment exists · ⚠️ 3 permanent · ❌ More than 3 permanent	Auto Requires Entra ID P2; N/A otherwise
IAM-24 Standard users cannot create groups L1	Checks that ordinary users are restricted from creating Microsoft 365 or security groups. If open, a compromised account can create abusable groups.	✅ Both Microsoft 365 and security group creation restricted · ⚠️ Only one restricted · ❌ Both open	Auto
IAM-25 Password reset written to on-premises directory (hybrid) L1	Checks that in a hybrid environment a self-service password reset also flows to the on-premises directory. Without it, self-reset stays incomplete.	✅ On for all users · ⚠️ Selected users only · ❌ Off	Auto N/A without on-premises directory sync
IAM-26 Passwords should not expire (modern practice) L1	Checks that passwords are not subject to forced periodic change. Forced change pushes users toward predictable passwords (NIST guidance).	✅ Passwords do not expire (no expiry) · ❌ Forced periodic change exists	Auto
IAM-27 Custom banned-password list defined L2	Checks that company-specific weak passwords are banned. The default list alone does not block company-specific passwords.	✅ Custom banned-password list defined · ❌ None	Auto Requires Entra ID P1; N/A otherwise
IAM-28 Continuous access evaluation (CAE) active L1	Checks that a session ends immediately when access is revoked. Without it, a stolen session stays valid for a long time.	✅ Continuous access evaluation on · ❌ Off	Auto Requires Business Premium (Entra P1); N/A otherwise
IAM-29 Token Protection active L2	Checks that session tokens are protected against being stolen and used on another device. Without protection, the risk of token theft rises.	✅ Token protection on · ⚠️ Off	Auto Requires Entra ID P2; N/A otherwise
IAM-30 Workload identity protection active L2	Checks that automated service identities (application accounts) are protected. Without it, these identities can be compromised.	✅ Workload identity protection on · ⚠️ Off	Auto Requires Entra ID P2; N/A otherwise
IAM-32 Access package (Entitlement Management) defined L2	Checks that resource access is managed automatically in packages. Without it, access is granted manually and uncontrolled.	✅ At least one access package defined · ⚠️ None	Auto Requires Entra ID P2; N/A otherwise
IAM-33 Lifecycle workflows active L2	Checks that onboarding, role-change and offboarding processes are automated. Without them, access updates are done by hand and can be missed.	✅ At least one lifecycle workflow defined · ⚠️ None	Auto Requires Entra ID P2; N/A otherwise
IAM-34 Compliant or joined device required L1	Checks that a managed (compliant or organization-joined) device is required for access. An unmanaged device can bypass controls.	✅ Compliant/joined device required · ❌ Not required	Auto Requires Business Premium (Entra P1); N/A otherwise
IAM-36 Sign-in frequency policy defined L2	Checks that users are asked to re-authenticate at set intervals. Without it, a stolen session can stay valid for months.	✅ Sign-in frequency limited · ❌ Not limited	Auto Requires Entra ID P2; N/A otherwise
IAM-37 Persistent browser session disabled L1	Checks that the session ends when the browser is closed. A persistent session is a risk on shared devices.	✅ A policy disables persistent browser sessions · ❌ None	Auto Requires Entra ID P2; N/A otherwise
IAM-39 Cross-tenant inbound access restricted L2	Checks that inbound access from external tenant users is limited. If not, unlimited access becomes possible.	✅ Inbound access blocked by default or open only to defined partners · ❌ Otherwise	Auto
IAM-40 User consent to app permissions restricted L1	Checks that users are restricted from granting third-party apps access to data. If open, malicious apps can be authorized.	✅ User consent restricted · ❌ Open	Auto
IAM-42 Phishing-resistant MFA (FIDO2/Windows Hello) L2	Checks that strong phishing-resistant MFA methods (security key, Windows Hello) are used. SMS or phone MFA is exposed to SIM-swap attacks.	✅ Phishing-resistant MFA required · ⚠️ Method on but not required · ❌ None	Auto Requires Entra ID P2; N/A otherwise
IAM-45 Terms of use defined L2	Checks that a terms-of-use document users must accept is defined. Without it, acceptable-use rules are not announced.	✅ At least one terms of use defined · ⚠️ None	Auto Requires Entra ID P2; N/A otherwise
IAM-46 Standard user access to the admin portal restricted L1	Checks that ordinary users are blocked from reading directory information in the admin portal. If open, reconnaissance is possible.	✅ Admin portal access restricted · ❌ Open	Auto
IAM-47 SMS-based MFA disabled L2	Checks that the SMS verification code method is off. SMS MFA can be bypassed by SIM-swap attacks.	✅ SMS-based MFA off · ❌ On	Auto
IAM-48 Standard users cannot create new tenants L1	Checks that ordinary users are blocked from creating new tenants. If open, a compromised account can exfiltrate data.	✅ New tenant creation blocked · ❌ Allowed	Auto
IAM-50 Authenticator number matching active L1	Checks that the on-screen number must be entered in the app during approval (number matching). It is the strongest defense against MFA-fatigue attacks.	✅ Number matching on · ❌ Off	Auto
IAM-52 Voice-call-based MFA disabled L2	Checks that phone-call verification is off. Voice-call MFA is exposed to voice phishing (vishing) attacks.	✅ Voice-call-based MFA off · ⚠️ On	Auto
IAM-53 Device registration (Entra ID) authority restricted L2	Checks that the authority to register devices to the tenant is limited. If open, an attacker can add their own device and bypass controls.	✅ Device registration restricted · ❌ Open	Auto
IAM-54 Global admin not local admin on device registration L1	Checks that the global admin is not made a local admin automatically on device registration. If they are, a compromised device puts the whole environment at risk.	✅ Global admin not an automatic local admin · ❌ Added automatically	Auto
IAM-55 Local admin assignment restricted on device registration L1	Checks that not all users are given automatic local admin on device registration. If they are, a user-level compromise turns into device takeover.	✅ Local admin assignment restricted · ❌ Open to everyone	Auto
IAM-56 Local admin password solution (LAPS) enabled L1	Checks that device local admin passwords are unique and managed automatically (LAPS). Without it, compromising one device spreads to others.	✅ LAPS enabled · ❌ Not enabled	Auto
IAM-57 No third-party integrated apps allowed L2	Checks that third-party apps are blocked from integrating with the tenant. If open, phishing can grant malicious apps email or file access.	✅ Third-party apps blocked · ❌ Allowed	Auto
IAM-58 Authenticator MFA-fatigue protection active L1	Checks that the app name and location are shown in approval notifications. Without them, repeated notifications can mislead the user (MFA fatigue).	✅ App name and location shown in the notification · ❌ Not shown	Auto
IAM-59 Weak MFA methods (SMS/voice) disabled L1	Checks that both SMS and voice-call verification are off. These methods are exposed to SIM-swap and voice-phishing attacks.	✅ Both SMS and voice-call MFA off · ❌ Either on	Auto
IAM-60 System-preferred MFA active L1	Checks that the system automatically recommends the most secure registered method to the user. Without it, the user may pick a weak method (SMS).	✅ System-preferred MFA on · ❌ Off	Auto
IAM-61 Email one-time passcode (Email OTP) disabled L2	Checks that the email one-time passcode method is off. If email is compromised, this method becomes an MFA-bypass tool.	✅ Email OTP off · ❌ On	Auto
IAM-62 On-premises password protection in enforce mode L1	Checks that in a hybrid environment on-premises directory passwords are also enforced against the banned-password list. If not enforced, weak passwords pass.	✅ In enforce mode · ❌ Not enforced	Auto Requires Entra ID P1; N/A without on-premises directory sync
IAM-63 All member users able to do MFA L1	Checks that member users have the method or license required for MFA. Those without cannot be prompted even if an MFA policy targets them.	✅ All ready (0 missing) · ⚠️ 1–5 users missing · ❌ More than 5 missing	Auto N/A if data is unavailable
IAM-64 Managed device required for security-info registration L1	Checks that MFA or security-info registration can only be done from a managed device. Without it, an attacker with a stolen password can register from a malicious device.	✅ Managed device required for security-info registration · ❌ Not required	Auto Requires Entra ID P1; N/A otherwise
IAM-66 Device code sign-in flow blocked L1	Checks that the device-code sign-in flow is blocked. If open, in a phishing attack a user can unknowingly grant an attacker access.	✅ Device code flow blocked · ❌ On	Auto Requires Entra ID P1; N/A otherwise
IAM-67 Guest user role most restrictive L1	Checks that guest accounts can see the least information in the directory. The default role can read all directory objects and be used for reconnaissance.	✅ Guest role most restrictive · ❌ Not	Auto
IAM-68 External (B2B) invitations restricted to allowed domains L2	Checks that external guest invitations can only go to allowed domains. Without a list, any email can be added as a guest.		Auto Reviewed manually (not measured automatically)
IAM-69 Dynamic group defined for guest users L1	Checks that guest users are gathered into an automatic (dynamic) group. Without it, guests are missed in policy targeting and auditing.	✅ Dynamic group for guests exists · ⚠️ None	Auto
IAM-70 Privileged Role Administrator activation requires approval L1	Checks that activating the Privileged Role Administrator role is tied to approval. Without it, an attacker can derive global admin authority from this role.		Auto Reviewed manually (not measured automatically)
IAM-71 Public Microsoft 365 groups under control L2	Checks the number of public Microsoft 365 groups. The sites, channels and files in these groups are open to all users.	✅ None (0) · ⚠️ 1–3 groups · ❌ More than 3	Auto N/A if data is unavailable
IAM-72 Idle session timeout 3 hours or less L2	Checks that idle sessions on unmanaged devices are ended automatically. Without it, the session stays open even if the user does not sign out.	✅ Idle session timeout set · ❌ Not set	Auto
IAM-73 Third-party storage off in Office apps L2	Checks that external storage integrations like Dropbox, Box or Google Drive are off in Office apps. If on, corporate content can be moved outside.	✅ Third-party storage off · ❌ On	Auto
IAM-74 Interactive sign-in blocked for shared mailbox accounts L1	Checks that direct sign-in with shared mailbox accounts is blocked. If not, these ownerless accounts are exposed to password attacks.		Auto Reviewed manually (not measured automatically)
IAM-75 Calendar external sharing restricted L2	Checks that external sharing of calendars is restricted. If open, meeting titles and attendee information can leak outside.	✅ Calendar external sharing off · ❌ On	Auto N/A if no data
IAM-78 Customer Lockbox active L2	Checks that Microsoft support access to tenant data is tied to explicit approval (Customer Lockbox). Without it, this access happens without approval.	✅ Customer Lockbox on · ❌ Off	Auto N/A if no data
IAM-79 Bookings feature restricted L2	Checks that the Bookings feature is restricted. If open to everyone, employees can create external booking pages with the corporate brand.	✅ Bookings off · ⚠️ On	Auto N/A if no data
IAM-80 Privileged/admin accounts registered for MFA L1	Checks that admin accounts are registered for MFA. An unregistered admin account can be compromised by password attacks.	✅ No admin without MFA (0) · ❌ One or more	Auto N/A if data is unavailable
IAM-81 Passwordless/phishing-resistant authentication rolled out L2	Checks that at least one user can use a passwordless method (security key, Windows Hello, Authenticator). If none, the tenant depends entirely on passwords.	✅ A user with a passwordless method exists · ⚠️ None	Auto N/A if data is unavailable
IAM-82 Users registered the methods needed for password reset L2	Checks that users have registered the verification methods needed for self-service password reset. Those who have not cannot reset their own passwords.	✅ All registered (0 missing) · ⚠️ Some users not registered	Auto N/A if data is unavailable