standards.json

[
  {
    "name": "standards.MailContacts",
    "cat": "Global Standards",
    "tag": [],
    "helpText": "Defines the email address to receive general updates and information related to M365 subscriptions. Leave a contact field blank if you do not want to update the contact information.",
    "docsDescription": "",
    "executiveText": "Establishes designated contact email addresses for receiving important Microsoft 365 subscription updates and notifications. This ensures proper communication channels are maintained for general, security, marketing, and technical matters, improving organizational responsiveness to critical system updates.",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.MailContacts.GeneralContact",
        "label": "General Contact",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.MailContacts.SecurityContact",
        "label": "Security Contact",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.MailContacts.MarketingContact",
        "label": "Marketing Contact",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.MailContacts.TechContact",
        "label": "Technical Contact",
        "required": false
      }
    ],
    "label": "Set contact e-mails",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2022-03-13",
    "powershellEquivalent": "Set-MsolCompanyContactInformation",
    "recommendedBy": []
  },
  {
    "name": "standards.DeployMailContact",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Creates a new mail contact in Exchange Online across all selected tenants. The contact will be visible in the Global Address List.",
    "docsDescription": "This standard creates a new mail contact in Exchange Online. Mail contacts are useful for adding external email addresses to your organization's address book. They can be used for distribution lists, shared mailboxes, and other collaboration scenarios.",
    "executiveText": "Automatically creates external email contacts in the organization's address book, enabling seamless communication with external partners and vendors. This standardizes contact management across all company locations and improves collaboration efficiency.",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.DeployMailContact.ExternalEmailAddress",
        "label": "External Email Address",
        "required": true
      },
      {
        "type": "textField",
        "name": "standards.DeployMailContact.DisplayName",
        "label": "Display Name",
        "required": true
      },
      {
        "type": "textField",
        "name": "standards.DeployMailContact.FirstName",
        "label": "First Name",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.DeployMailContact.LastName",
        "label": "Last Name",
        "required": false
      }
    ],
    "label": "Deploy Mail Contact",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-03-19",
    "powershellEquivalent": "New-MailContact",
    "recommendedBy": ["CIPP"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.DeployContactTemplates",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Creates new mail contacts in Exchange Online across all selected tenants based on the selected templates. The contact will be visible in the Global Address List unless hidden.",
    "docsDescription": "This standard creates new mail contacts in Exchange Online based on the selected templates. Mail contacts are useful for adding external email addresses to your organization's address book. They can be used for distribution lists, shared mailboxes, and other collaboration scenarios.",
    "executiveText": "Deploys standardized external contact templates across all company locations, ensuring consistent communication channels with key external partners, vendors, and stakeholders. This streamlines contact management and maintains uniform business relationships.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": false,
        "label": "Select Mail Contact Templates",
        "name": "standards.DeployContactTemplates.templateIds",
        "api": {
          "url": "/api/ListContactTemplates",
          "labelField": "name",
          "valueField": "GUID",
          "queryKey": "Contact Templates"
        }
      }
    ],
    "label": "Deploy Mail Contact Template",
    "disabledFeatures": { "report": false, "warn": false, "remediate": false },
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-05-31",
    "powershellEquivalent": "New-MailContact",
    "recommendedBy": ["CIPP"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.AuditLog",
    "cat": "Global Standards",
    "tag": ["CIS M365 7.0.0 (3.1.1)", "mip_search_auditlog", "NIST CSF 2.0 (DE.CM-09)"],
    "appliesToTest": ["CISAMSEXO171", "CISAMSEXO173", "CIS_3_1_1"],
    "helpText": "Enables the Unified Audit Log for tracking and auditing activities. Also runs Enable-OrganizationCustomization if necessary.",
    "executiveText": "Activates comprehensive activity logging across Microsoft 365 services to track user actions, system changes, and security events. This provides essential audit trails for compliance requirements, security investigations, and regulatory reporting.",
    "addedComponent": [],
    "label": "Enable the Unified Audit Log",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2021-11-16",
    "powershellEquivalent": "Enable-OrganizationCustomization",
    "recommendedBy": ["CIS", "CIPP"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.RestrictThirdPartyStorageServices",
    "cat": "Global Standards",
    "tag": ["CIS M365 7.0.0 (1.3.7)"],
    "appliesToTest": ["CIS_1_3_7"],
    "helpText": "Restricts third-party storage services in Microsoft 365 on the web by managing the Microsoft 365 on the web service principal. This disables integrations with services like Dropbox, Google Drive, Box, and other third-party storage providers.",
    "docsDescription": "Third-party storage can be enabled for users in Microsoft 365, allowing them to store and share documents using services such as Dropbox, alongside OneDrive and team sites. This standard ensures Microsoft 365 on the web third-party storage services are restricted by creating and disabling the Microsoft 365 on the web service principal (appId: c1f33bc0-bdb4-4248-ba9b-096807ddb43e). By using external storage services an organization may increase the risk of data breaches and unauthorized access to confidential information. Additionally, third-party services may not adhere to the same security standards as the organization, making it difficult to maintain data privacy and security. Impact is highly dependent upon current practices - if users do not use other storage providers, then minimal impact is likely. However, if users regularly utilize providers outside of the tenant this will affect their ability to continue to do so.",
    "executiveText": "Prevents employees from using external cloud storage services like Dropbox, Google Drive, and Box within Microsoft 365, reducing data security risks and ensuring all company data remains within controlled corporate systems. This helps maintain data governance and prevents potential data leaks to unauthorized platforms.",
    "addedComponent": [],
    "label": "Restrict third-party storage services in Microsoft 365 on the web",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2025-06-06",
    "powershellEquivalent": "New-MgServicePrincipal and Update-MgServicePrincipal",
    "recommendedBy": ["CIS"],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.ProfilePhotos",
    "cat": "Global Standards",
    "tag": [],
    "helpText": "Controls whether users can set their own profile photos in Microsoft 365.",
    "docsDescription": "Controls whether users can set their own profile photos in Microsoft 365. When disabled, only User and Global administrators can update profile photos for users.",
    "executiveText": "Manages user profile photo permissions within Microsoft 365, allowing organizations to control whether employees can upload their own photos or require administrative approval. This helps maintain professional appearance standards and prevents inappropriate images in corporate directories.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "Select value",
        "name": "standards.ProfilePhotos.state",
        "options": [
          { "label": "Enabled", "value": "enabled" },
          { "label": "Disabled", "value": "disabled" }
        ]
      }
    ],
    "label": "Allow users to set profile photos",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-01-19",
    "powershellEquivalent": "Set-OrganizationConfig -ProfilePhotoOptions EnablePhotos and Update-MgBetaAdminPeople",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.PhishProtection",
    "cat": "Global Standards",
    "tag": [],
    "helpText": "Adds branding to the logon page that only appears if the url is not login.microsoftonline.com. This potentially prevents AITM attacks via EvilNginx. This will also automatically generate alerts if a clone of your login page has been found when set to Remediate.",
    "executiveText": "Implements advanced phishing protection by adding visual indicators to login pages that help users identify legitimate Microsoft login pages versus fraudulent copies. This security measure protects against sophisticated phishing attacks that attempt to steal employee credentials.",
    "addedComponent": [],
    "label": "Enable Phishing Protection system via branding CSS",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-01-22",
    "disabledFeatures": { "report": true, "warn": true, "remediate": false },
    "powershellEquivalent": "Portal only",
    "recommendedBy": ["CIPP"],
    "requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2", "OFFICE_BUSINESS"]
  },
  {
    "name": "standards.Branding",
    "cat": "Global Standards",
    "tag": [],
    "helpText": "Sets the branding for the tenant. This includes the login page, and the Office 365 portal.",
    "executiveText": "Customizes Microsoft 365 login pages and portals with company branding, including logos, colors, and messaging. This creates a consistent corporate identity experience for employees and reinforces brand recognition while maintaining professional appearance across all Microsoft services.",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.Branding.signInPageText",
        "label": "Sign-in page text",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.Branding.usernameHintText",
        "label": "Username hint Text",
        "required": false
      },
      {
        "type": "switch",
        "name": "standards.Branding.hideAccountResetCredentials",
        "label": "Hide self-service password reset"
      },
      {
        "type": "autoComplete",
        "multiple": false,
        "label": "Visual Template",
        "name": "standards.Branding.layoutTemplateType",
        "options": [
          { "label": "Full-screen background", "value": "default" },
          { "label": "Partial-screen background", "value": "verticalSplit" }
        ]
      },
      { "type": "switch", "name": "standards.Branding.isHeaderShown", "label": "Show header" },
      { "type": "switch", "name": "standards.Branding.isFooterShown", "label": "Show footer" }
    ],
    "label": "Set branding for the tenant",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-05-13",
    "powershellEquivalent": "Portal only",
    "recommendedBy": [],
    "requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2", "OFFICE_BUSINESS"]
  },
  {
    "name": "standards.EnableCustomerLockbox",
    "cat": "Global Standards",
    "tag": ["CIS M365 7.0.0 (1.3.6)", "CustomerLockBoxEnabled"],
    "appliesToTest": ["CIS_1_3_6"],
    "helpText": "**Requires Entra ID P2.** Enables Customer Lockbox that offers an approval process for Microsoft support to access organization data",
    "docsDescription": "**Requires Entra ID P2.** Customer Lockbox ensures that Microsoft can't access your content to do service operations without your explicit approval. Customer Lockbox ensures only authorized requests allow access to your organizations data.",
    "executiveText": "Requires explicit organizational approval before Microsoft support staff can access company data for service operations. This provides an additional layer of data protection and ensures the organization maintains control over who can access sensitive business information, even during technical support scenarios.",
    "addedComponent": [],
    "label": "Enable Customer Lockbox",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-01-08",
    "powershellEquivalent": "Set-OrganizationConfig -CustomerLockBoxEnabled $true",
    "recommendedBy": ["CIS"],
    "requiredCapabilities": ["CustomerLockbox"]
  },
  {
    "name": "standards.EnablePronouns",
    "cat": "Global Standards",
    "tag": [],
    "helpText": "Enables the Pronouns feature for the tenant. This allows users to set their pronouns in their profile.",
    "executiveText": "Allows employees to display their preferred pronouns in their Microsoft 365 profiles, supporting inclusive workplace practices and helping colleagues communicate respectfully. This feature enhances diversity and inclusion initiatives while fostering a more welcoming work environment.",
    "addedComponent": [],
    "label": "Enable Pronouns",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-06-05",
    "powershellEquivalent": "Update-MgBetaAdminPeoplePronoun -IsEnabledInOrganization:$true",
    "recommendedBy": []
  },
  {
    "name": "standards.EnableNamePronunciation",
    "cat": "Global Standards",
    "tag": [],
    "helpText": "Enables the Name Pronunciation feature for the tenant. This allows users to set their name pronunciation in their profile.",
    "docsDescription": "Enables the Name Pronunciation feature for the tenant. This allows users to set their name pronunciation in their profile.",
    "executiveText": "Enables employees to add pronunciation guides for their names in Microsoft 365 profiles, improving communication and respect in diverse workplaces. This feature helps colleagues pronounce names correctly, enhancing professional relationships and inclusive culture.",
    "addedComponent": [],
    "label": "Enable Name Pronunciation",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-06-06",
    "recommendedBy": ["CIPP"]
  },
  {
    "name": "standards.AnonReportDisable",
    "cat": "Global Standards",
    "tag": [],
    "helpText": "Shows usernames instead of pseudo anonymised names in reports. This standard is required for reporting to work correctly.",
    "docsDescription": "Microsoft announced some APIs and reports no longer return names, to comply with compliance and legal requirements in specific countries. This proves an issue for a lot of MSPs because those reports are often helpful for engineers. This standard applies a setting that shows usernames in those API calls / reports.",
    "executiveText": "Configures Microsoft 365 reports to display actual usernames instead of anonymized identifiers, enabling IT administrators to effectively troubleshoot issues and generate meaningful usage reports. This improves operational efficiency and system management capabilities.",
    "addedComponent": [],
    "label": "Enable Usernames instead of pseudo anonymised names in reports",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2021-11-16",
    "powershellEquivalent": "Update-MgBetaAdminReportSetting -BodyParameter @{displayConcealedNames = $true}",
    "recommendedBy": ["CIPP"]
  },
  {
    "name": "standards.DisableGuestDirectory",
    "cat": "Global Standards",
    "tag": [
      "CIS M365 7.0.0 (5.1.6.2)",
      "CISA (MS.AAD.5.1v1)",
      "EIDSCA.AP14",
      "EIDSCA.ST08",
      "EIDSCA.ST09",
      "NIST CSF 2.0 (PR.AA-05)",
      "SMB1001 (2.8)"
    ],
    "appliesToTest": [
      "CIS_5_1_6_2",
      "EIDSCAAP07",
      "EIDSCAAP14",
      "EIDSCAST08",
      "EIDSCAST09",
      "SMB1001_2_8",
      "ZTNA21792"
    ],
    "helpText": "Disables Guest access to enumerate directory objects. This prevents guest users from seeing other users or guests in the directory.",
    "docsDescription": "Sets it so guests can view only their own user profile. Permission to view other users isn't allowed. Also restricts guest users from seeing the membership of groups they're in. See exactly what get locked down in the [Microsoft documentation.](https://learn.microsoft.com/en-us/entra/fundamentals/users-default-permissions)",
    "executiveText": "Restricts external guest users from viewing the company's employee directory and organizational structure, protecting sensitive information about staff and internal groups. This security measure prevents unauthorized access to corporate contact information while still allowing necessary collaboration.",
    "addedComponent": [],
    "label": "Restrict guest user access to directory objects",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2022-05-04",
    "powershellEquivalent": "Set-AzureADMSAuthorizationPolicy -GuestUserRoleId '2af84b1e-32c8-42b7-82bc-daa82404023b'",
    "recommendedBy": ["CIPP"]
  },
  {
    "name": "standards.DisableBasicAuthSMTP",
    "cat": "Global Standards",
    "tag": ["CIS M365 7.0.0 (6.5.4)", "NIST CSF 2.0 (PR.IR-01)"],
    "appliesToTest": ["CISAMSEXO51", "CIS_6_5_4", "ZTNA21799"],
    "helpText": "Disables SMTP AUTH organization-wide, impacting POP and IMAP clients that rely on SMTP for sending emails. Default for new tenants. For more information, see the [Microsoft documentation](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission)",
    "docsDescription": "Disables tenant-wide SMTP basic authentication, including for all explicitly enabled users, impacting POP and IMAP clients that rely on SMTP for sending emails. For more information, see the [Microsoft documentation](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission).",
    "executiveText": "Disables outdated email authentication methods that are vulnerable to security attacks, forcing applications and devices to use modern, more secure authentication protocols. This reduces the risk of email-based security breaches and credential theft.",
    "addedComponent": [],
    "label": "Disable SMTP Basic Authentication",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2021-11-16",
    "powershellEquivalent": "Set-TransportConfig -SmtpClientAuthenticationDisabled $true",
    "recommendedBy": ["CIS", "CIPP"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.ActivityBasedTimeout",
    "cat": "Global Standards",
    "tag": ["CIS M365 7.0.0 (1.3.2)", "spo_idle_session_timeout", "NIST CSF 2.0 (PR.AA-03)"],
    "appliesToTest": ["CIS_1_3_2", "ZTNA21813", "ZTNA21814", "ZTNA21815"],
    "helpText": "Enables and sets Idle session timeout for Microsoft 365 to 1 hour. This policy affects most M365 web apps",
    "executiveText": "Automatically logs out inactive users from Microsoft 365 applications after a specified time period to prevent unauthorized access to company data on unattended devices. This security measure protects against data breaches when employees leave workstations unlocked.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "Select value",
        "name": "standards.ActivityBasedTimeout.timeout",
        "options": [
          { "label": "1 Hour", "value": "01:00:00" },
          { "label": "3 Hours", "value": "03:00:00" },
          { "label": "6 Hours", "value": "06:00:00" },
          { "label": "12 Hours", "value": "12:00:00" },
          { "label": "24 Hours", "value": "1.00:00:00" }
        ]
      }
    ],
    "label": "Enable Activity based Timeout",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2022-04-13",
    "powershellEquivalent": "Portal or Graph API",
    "recommendedBy": ["CIS"]
  },
  {
    "name": "standards.AuthMethodsSettings",
    "cat": "Entra (AAD) Standards",
    "tag": [
      "CIS M365 7.0.0 (5.2.3.6)",
      "EIDSCA.AG01",
      "EIDSCA.AG02",
      "EIDSCA.AG03",
      "SMB1001 (2.8)"
    ],
    "appliesToTest": [
      "CIS_5_2_3_6",
      "EIDSCAAG01",
      "EIDSCAAG02",
      "EIDSCAAG03",
      "SMB1001_2_8",
      "ZTNA21841"
    ],
    "helpText": "Configures the report suspicious activity settings and system credential preferences in the authentication methods policy.",
    "docsDescription": "Controls the authentication methods policy settings for reporting suspicious activity and system credential preferences. These settings help enhance the security of authentication in your organization.",
    "executiveText": "Configures security settings that allow users to report suspicious login attempts and manages how the system handles authentication credentials. This enhances overall security by enabling early detection of potential security threats and optimizing authentication processes.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "required": false,
        "name": "standards.AuthMethodsSettings.ReportSuspiciousActivity",
        "label": "Report Suspicious Activity Settings",
        "options": [
          { "label": "Microsoft managed", "value": "default" },
          { "label": "Enabled", "value": "enabled" },
          { "label": "Disabled", "value": "disabled" }
        ]
      },
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "required": false,
        "name": "standards.AuthMethodsSettings.SystemCredential",
        "label": "System Credential Preferences",
        "options": [
          { "label": "Microsoft managed", "value": "default" },
          { "label": "Enabled", "value": "enabled" },
          { "label": "Disabled", "value": "disabled" }
        ]
      }
    ],
    "label": "Configure Authentication Methods Policy Settings",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-02-10",
    "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicy",
    "recommendedBy": []
  },
  {
    "name": "standards.AuthenticationMethods",
    "cat": "Entra (AAD) Standards",
    "tag": [],
    "helpText": "Configures all authentication methods for the tenant including Microsoft Authenticator, FIDO2, SMS, Voice, Email OTP, Temporary Access Pass, Software OATH, Hardware OATH, Certificate-based, and QR Code Pin. Enable or disable each method and optionally target specific groups.",
    "docsDescription": "Unified standard to configure all authentication method policies in a single place. Each method can be independently enabled or disabled, targeted to all users or specific groups using group name wildcards, and configured with method-specific settings such as TAP lifetime, QR code pin length, and Authenticator software OTP.",
    "executiveText": "Provides centralized control over all tenant authentication methods from a single standard. Administrators can enable phishing-resistant methods like FIDO2 and Microsoft Authenticator while disabling less secure options like SMS and Voice. Each method supports group-level targeting using wildcard group names, allowing staged rollouts and granular control.",
    "addedComponent": [
      {
        "type": "switch",
        "name": "standards.AuthenticationMethods.MicrosoftAuthenticatorEnabled",
        "label": "Microsoft Authenticator",
        "defaultValue": false
      },
      {
        "type": "textField",
        "name": "standards.AuthenticationMethods.MicrosoftAuthenticatorGroup",
        "label": "Target Group Name (wildcard supported, blank = All Users)",
        "required": false,
        "condition": {
          "field": "standards.AuthenticationMethods.MicrosoftAuthenticatorEnabled",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "switch",
        "name": "standards.AuthenticationMethods.MicrosoftAuthenticatorSoftwareOath",
        "label": "Enable Software OTP in Authenticator",
        "defaultValue": false,
        "condition": {
          "field": "standards.AuthenticationMethods.MicrosoftAuthenticatorEnabled",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "Number Matching",
        "name": "standards.AuthenticationMethods.MicrosoftAuthenticatorNumberMatching",
        "options": [
          { "label": "Microsoft managed", "value": "default" },
          { "label": "Enabled", "value": "enabled" },
          { "label": "Disabled", "value": "disabled" }
        ],
        "condition": {
          "field": "standards.AuthenticationMethods.MicrosoftAuthenticatorEnabled",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "Show Application Name in Push Notifications",
        "name": "standards.AuthenticationMethods.MicrosoftAuthenticatorDisplayAppInfo",
        "options": [
          { "label": "Microsoft managed", "value": "default" },
          { "label": "Enabled", "value": "enabled" },
          { "label": "Disabled", "value": "disabled" }
        ],
        "condition": {
          "field": "standards.AuthenticationMethods.MicrosoftAuthenticatorEnabled",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "Show Geographic Location in Push Notifications",
        "name": "standards.AuthenticationMethods.MicrosoftAuthenticatorDisplayLocation",
        "options": [
          { "label": "Microsoft managed", "value": "default" },
          { "label": "Enabled", "value": "enabled" },
          { "label": "Disabled", "value": "disabled" }
        ],
        "condition": {
          "field": "standards.AuthenticationMethods.MicrosoftAuthenticatorEnabled",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "Companion App (Authenticator Lite)",
        "name": "standards.AuthenticationMethods.MicrosoftAuthenticatorCompanionApp",
        "options": [
          { "label": "Microsoft managed", "value": "default" },
          { "label": "Enabled", "value": "enabled" },
          { "label": "Disabled", "value": "disabled" }
        ],
        "condition": {
          "field": "standards.AuthenticationMethods.MicrosoftAuthenticatorEnabled",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "switch",
        "name": "standards.AuthenticationMethods.FIDO2Enabled",
        "label": "FIDO2 Security Keys",
        "defaultValue": false
      },
      {
        "type": "textField",
        "name": "standards.AuthenticationMethods.FIDO2Group",
        "label": "Target Group Name (wildcard supported, blank = All Users)",
        "required": false,
        "condition": {
          "field": "standards.AuthenticationMethods.FIDO2Enabled",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "switch",
        "name": "standards.AuthenticationMethods.TAPEnabled",
        "label": "Temporary Access Pass",
        "defaultValue": false
      },
      {
        "type": "textField",
        "name": "standards.AuthenticationMethods.TAPGroup",
        "label": "Target Group Name (wildcard supported, blank = All Users)",
        "required": false,
        "condition": {
          "field": "standards.AuthenticationMethods.TAPEnabled",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "TAP Usage Mode",
        "name": "standards.AuthenticationMethods.TAPUsableOnce",
        "options": [
          { "label": "Only Once", "value": "true" },
          { "label": "Multiple Logons", "value": "false" }
        ],
        "condition": {
          "field": "standards.AuthenticationMethods.TAPEnabled",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "number",
        "name": "standards.AuthenticationMethods.TAPDefaultLifetime",
        "label": "TAP Default Lifetime (minutes)",
        "defaultValue": 60,
        "condition": {
          "field": "standards.AuthenticationMethods.TAPEnabled",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "number",
        "name": "standards.AuthenticationMethods.TAPMinLifetime",
        "label": "TAP Minimum Lifetime (minutes)",
        "defaultValue": 60,
        "condition": {
          "field": "standards.AuthenticationMethods.TAPEnabled",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "number",
        "name": "standards.AuthenticationMethods.TAPMaxLifetime",
        "label": "TAP Maximum Lifetime (minutes)",
        "defaultValue": 480,
        "condition": {
          "field": "standards.AuthenticationMethods.TAPEnabled",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "number",
        "name": "standards.AuthenticationMethods.TAPDefaultLength",
        "label": "TAP Length (characters)",
        "defaultValue": 8,
        "condition": {
          "field": "standards.AuthenticationMethods.TAPEnabled",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "switch",
        "name": "standards.AuthenticationMethods.SoftwareOathEnabled",
        "label": "Third-Party Software OATH Tokens",
        "defaultValue": false
      },
      {
        "type": "textField",
        "name": "standards.AuthenticationMethods.SoftwareOathGroup",
        "label": "Target Group Name (wildcard supported, blank = All Users)",
        "required": false,
        "condition": {
          "field": "standards.AuthenticationMethods.SoftwareOathEnabled",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "switch",
        "name": "standards.AuthenticationMethods.HardwareOathEnabled",
        "label": "Hardware OATH Tokens",
        "defaultValue": false
      },
      {
        "type": "textField",
        "name": "standards.AuthenticationMethods.HardwareOathGroup",
        "label": "Target Group Name (wildcard supported, blank = All Users)",
        "required": false,
        "condition": {
          "field": "standards.AuthenticationMethods.HardwareOathEnabled",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "switch",
        "name": "standards.AuthenticationMethods.SMSEnabled",
        "label": "SMS",
        "defaultValue": false
      },
      {
        "type": "textField",
        "name": "standards.AuthenticationMethods.SMSGroup",
        "label": "Target Group Name (wildcard supported, blank = All Users)",
        "required": false,
        "condition": {
          "field": "standards.AuthenticationMethods.SMSEnabled",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "switch",
        "name": "standards.AuthenticationMethods.VoiceEnabled",
        "label": "Voice Call",
        "defaultValue": false
      },
      {
        "type": "textField",
        "name": "standards.AuthenticationMethods.VoiceGroup",
        "label": "Target Group Name (wildcard supported, blank = All Users)",
        "required": false,
        "condition": {
          "field": "standards.AuthenticationMethods.VoiceEnabled",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "switch",
        "name": "standards.AuthenticationMethods.EmailEnabled",
        "label": "Email OTP",
        "defaultValue": false
      },
      {
        "type": "textField",
        "name": "standards.AuthenticationMethods.EmailGroup",
        "label": "Target Group Name (wildcard supported, blank = All Users)",
        "required": false,
        "condition": {
          "field": "standards.AuthenticationMethods.EmailEnabled",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "switch",
        "name": "standards.AuthenticationMethods.x509CertificateEnabled",
        "label": "Certificate-Based Authentication",
        "defaultValue": false
      },
      {
        "type": "textField",
        "name": "standards.AuthenticationMethods.x509CertificateGroup",
        "label": "Target Group Name (wildcard supported, blank = All Users)",
        "required": false,
        "condition": {
          "field": "standards.AuthenticationMethods.x509CertificateEnabled",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "switch",
        "name": "standards.AuthenticationMethods.QRCodePinEnabled",
        "label": "QR Code Pin",
        "defaultValue": false
      },
      {
        "type": "textField",
        "name": "standards.AuthenticationMethods.QRCodePinGroup",
        "label": "Target Group Name (wildcard supported, blank = All Users)",
        "required": false,
        "condition": {
          "field": "standards.AuthenticationMethods.QRCodePinEnabled",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "number",
        "name": "standards.AuthenticationMethods.QRCodeLifetimeInDays",
        "label": "QR Code Lifetime (days, 1-395)",
        "defaultValue": 365,
        "condition": {
          "field": "standards.AuthenticationMethods.QRCodePinEnabled",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "number",
        "name": "standards.AuthenticationMethods.QRCodePinLength",
        "label": "QR Code PIN Length (8-20)",
        "defaultValue": 8,
        "condition": {
          "field": "standards.AuthenticationMethods.QRCodePinEnabled",
          "compareType": "is",
          "compareValue": true
        }
      }
    ],
    "label": "Configure Authentication Methods",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2026-05-28",
    "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration",
    "recommendedBy": ["CIPP"]
  },
  {
    "name": "standards.AdminSSPR",
    "cat": "Entra (AAD) Standards",
    "tag": ["EIDSCA.AP01"],
    "appliesToTest": ["EIDSCAAP01", "ZTNA21842"],
    "helpText": "Controls whether administrators are allowed to use Self-Service Password Reset through the Microsoft Entra authorization policy.",
    "docsDescription": "Configures the allowedToUseSSPR property on the Microsoft Entra authorization policy. Microsoft documents this property as controlling whether administrators of the tenant can use Self-Service Password Reset. Use this standard to explicitly enable or disable administrator SSPR based on your security policy.",
    "executiveText": "Controls whether tenant administrators can reset their own passwords through Self-Service Password Reset. Disabling this capability forces privileged accounts through more controlled recovery processes and reduces the risk of self-service recovery being misused on administrative identities.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "Select value",
        "name": "standards.AdminSSPR.state",
        "options": [
          { "label": "Enabled", "value": "enabled" },
          { "label": "Disabled", "value": "disabled" }
        ]
      }
    ],
    "label": "Set administrator Self-Service Password Reset state",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2026-04-21",
    "powershellEquivalent": "Update-MgBetaPolicyAuthorizationPolicy",
    "recommendedBy": ["CIPP"]
  },
  {
    "name": "standards.AuthMethodsPolicyMigration",
    "cat": "Entra (AAD) Standards",
    "tag": [],
    "appliesToTest": ["EIDSCAAG01"],
    "helpText": "Completes the migration of authentication methods policy to the new format",
    "docsDescription": "Sets the authentication methods policy migration state to complete. This is required when migrating from legacy authentication policies to the new unified authentication methods policy.",
    "executiveText": "Completes the transition from legacy authentication policies to Microsoft's modern unified authentication methods policy, ensuring the organization benefits from the latest security features and management capabilities. This migration enables enhanced security controls and simplified policy management.",
    "addedComponent": [],
    "label": "Complete Authentication Methods Policy Migration",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2025-07-07",
    "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicy",
    "recommendedBy": ["CIPP"]
  },
  {
    "name": "standards.AppDeploy",
    "cat": "Entra (AAD) Standards",
    "tag": [],
    "helpText": "Deploys selected applications to the tenant. Use a comma separated list of application IDs to deploy multiple applications. Permissions will be copied from the source application.",
    "docsDescription": "Uses the CIPP functionality that deploys applications across an entire tenant base as a standard.",
    "executiveText": "Automatically deploys approved business applications across all company locations and users, ensuring consistent access to essential tools and maintaining standardized software configurations. This streamlines application management and reduces IT deployment overhead.",
    "addedComponent": [
      {
        "type": "select",
        "multiple": false,
        "creatable": false,
        "label": "App Approval Mode",
        "name": "standards.AppDeploy.mode",
        "options": [
          { "label": "Template", "value": "template" },
          { "label": "Copy Permissions", "value": "copy" }
        ]
      },
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": false,
        "label": "Select Applications",
        "name": "standards.AppDeploy.templateIds",
        "api": {
          "url": "/api/ListAppApprovalTemplates",
          "labelField": "TemplateName",
          "valueField": "TemplateId",
          "queryKey": "StdAppApprovalTemplateList",
          "addedField": { "AppId": "AppId" }
        },
        "condition": {
          "field": "standards.AppDeploy.mode",
          "compareType": "is",
          "compareValue": "template"
        }
      },
      {
        "type": "textField",
        "name": "standards.AppDeploy.appids",
        "label": "Application IDs, comma separated",
        "condition": {
          "field": "standards.AppDeploy.mode",
          "compareType": "isNot",
          "compareValue": "template"
        }
      }
    ],
    "label": "Deploy Application",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-07-07",
    "powershellEquivalent": "Portal or Graph API",
    "recommendedBy": []
  },
  {
    "name": "standards.laps",
    "cat": "Entra (AAD) Standards",
    "tag": ["CIS M365 7.0.0 (5.1.4.5)", "SMB1001 (2.2)"],
    "appliesToTest": ["CIS_5_1_4_5", "SMB1001_2_2", "ZTNA21953", "ZTNA21955", "ZTNA24560"],
    "helpText": "Enables the tenant to use LAPS. You must still create a policy for LAPS to be active on all devices. Use the template standards to deploy this by default.",
    "docsDescription": "Enables the LAPS functionality on the tenant. Prerequisite for using Windows LAPS via Azure AD.",
    "executiveText": "Enables Local Administrator Password Solution (LAPS) capability, which automatically manages and rotates local administrator passwords on company computers. This significantly improves security by preventing the use of shared or static administrator passwords that could be exploited by attackers.",
    "addedComponent": [],
    "label": "Enable LAPS on the tenant",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2023-04-25",
    "powershellEquivalent": "Portal or Graph API",
    "recommendedBy": ["CIPP"]
  },
  {
    "name": "standards.PWdisplayAppInformationRequiredState",
    "cat": "Entra (AAD) Standards",
    "tag": [
      "CIS M365 7.0.0 (5.2.3.1)",
      "EIDSCA.AM03",
      "EIDSCA.AM04",
      "EIDSCA.AM06",
      "EIDSCA.AM07",
      "EIDSCA.AM09",
      "EIDSCA.AM10",
      "NIST CSF 2.0 (PR.AA-03)"
    ],
    "appliesToTest": [
      "CIS_5_2_3_1",
      "EIDSCAAM01",
      "EIDSCAAM03",
      "EIDSCAAM04",
      "EIDSCAAM06",
      "EIDSCAAM07",
      "EIDSCAAM09",
      "EIDSCAAM10"
    ],
    "helpText": "Enables the MS authenticator app to display information about the app that is requesting authentication. This displays the application name.",
    "docsDescription": "Allows users to use Passwordless with Number Matching and adds location information from the last request",
    "executiveText": "Enhances authentication security by requiring users to match numbers and showing detailed information about login requests, including application names and location data. This helps employees verify legitimate login attempts and prevents unauthorized access through more secure authentication methods.",
    "addedComponent": [],
    "label": "Enable Passwordless with Location information and Number Matching",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2021-11-16",
    "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration",
    "recommendedBy": ["CIS"]
  },
  {
    "name": "standards.allowOTPTokens",
    "cat": "Entra (AAD) Standards",
    "tag": ["EIDSCA.AM02"],
    "appliesToTest": ["EIDSCAAM02"],
    "helpText": "Allows you to use MS authenticator OTP token generator",
    "docsDescription": "Allows you to use Microsoft Authenticator OTP token generator. Useful for using the NPS extension as MFA on VPN clients.",
    "executiveText": "Enables one-time password generation through Microsoft Authenticator app, providing an additional secure authentication method for employees. This is particularly useful for secure VPN access and other systems requiring multi-factor authentication.",
    "addedComponent": [],
    "label": "Enable OTP via Authenticator",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2023-12-06",
    "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration",
    "recommendedBy": []
  },
  {
    "name": "standards.PWcompanionAppAllowedState",
    "cat": "Entra (AAD) Standards",
    "tag": ["CIS M365 7.0.0 (5.2.3.10)", "EIDSCA.AM01"],
    "appliesToTest": ["CIS_5_2_3_10", "EIDSCAAM01"],
    "helpText": "Sets the state of Authenticator Lite, Authenticator lite is a companion app for passwordless authentication.",
    "docsDescription": "Sets the Authenticator Lite state to enabled. This allows users to use the Authenticator Lite built into the Outlook app instead of the full Authenticator app.",
    "executiveText": "Enables a simplified authentication experience by allowing users to authenticate directly through Outlook without requiring a separate authenticator app. This improves user convenience while maintaining security standards for passwordless authentication.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "Select value",
        "name": "standards.PWcompanionAppAllowedState.state",
        "options": [
          { "label": "Enabled", "value": "enabled" },
          { "label": "Disabled", "value": "disabled" },
          { "label": "Microsoft managed", "value": "default" }
        ]
      }
    ],
    "label": "Set Authenticator Lite state",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2023-05-18",
    "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration",
    "recommendedBy": []
  },
  {
    "name": "standards.EnableFIDO2",
    "cat": "Entra (AAD) Standards",
    "tag": [
      "EIDSCA.AF01",
      "EIDSCA.AF02",
      "EIDSCA.AF03",
      "EIDSCA.AF04",
      "EIDSCA.AF05",
      "EIDSCA.AF06",
      "NIST CSF 2.0 (PR.AA-03)",
      "SMB1001 (2.5)",
      "SMB1001 (2.6)",
      "SMB1001 (2.9)"
    ],
    "appliesToTest": [
      "EIDSCAAF01",
      "EIDSCAAF02",
      "EIDSCAAF03",
      "EIDSCAAF04",
      "EIDSCAAF05",
      "EIDSCAAF06",
      "SMB1001_2_5",
      "SMB1001_2_6",
      "SMB1001_2_9",
      "ZTNA21838",
      "ZTNA21839"
    ],
    "helpText": "Enables the FIDO2 authenticationMethod for the tenant",
    "docsDescription": "Enables FIDO2 capabilities for the tenant. This allows users to use FIDO2 keys like a Yubikey for authentication.",
    "executiveText": "Enables support for hardware security keys (like YubiKey) that provide the highest level of authentication security. These physical devices prevent phishing attacks and credential theft, offering superior protection for high-value accounts and sensitive business operations.",
    "addedComponent": [],
    "label": "Enable FIDO2 capabilities",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2022-12-08",
    "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration",
    "recommendedBy": ["CIPP"]
  },
  {
    "name": "standards.EnableHardwareOAuth",
    "cat": "Entra (AAD) Standards",
    "tag": ["SMB1001 (2.5)", "SMB1001 (2.6)", "SMB1001 (2.9)"],
    "appliesToTest": ["SMB1001_2_5", "SMB1001_2_6", "SMB1001_2_9"],
    "helpText": "Enables the HardwareOath authenticationMethod for the tenant. This allows you to use hardware tokens for generating 6 digit MFA codes.",
    "docsDescription": "Enables Hardware OAuth tokens for the tenant. This allows users to use hardware tokens like a Yubikey for authentication.",
    "executiveText": "Enables physical hardware tokens that generate secure authentication codes, providing an alternative to smartphone-based authentication. This is particularly valuable for employees who cannot use mobile devices or require the highest security standards for accessing sensitive systems.",
    "addedComponent": [],
    "label": "Enable Hardware OAuth tokens",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2023-12-18",
    "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration",
    "recommendedBy": []
  },
  {
    "name": "standards.allowOAuthTokens",
    "cat": "Entra (AAD) Standards",
    "tag": ["EIDSCA.AT01", "EIDSCA.AT02"],
    "appliesToTest": ["EIDSCAAT01", "EIDSCAAT02"],
    "helpText": "Allows you to use any software OAuth token generator",
    "docsDescription": "Enables OTP Software OAuth tokens for the tenant. This allows users to use OTP codes generated via software, like a password manager to be used as an authentication method.",
    "executiveText": "Allows employees to use third-party authentication apps and password managers to generate secure login codes, providing flexibility in authentication methods while maintaining security standards. This accommodates diverse user preferences and existing security tools.",
    "addedComponent": [],
    "label": "Enable OTP Software OAuth tokens",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2022-12-18",
    "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration",
    "recommendedBy": []
  },
  {
    "name": "standards.FormsPhishingProtection",
    "cat": "Global Standards",
    "tag": ["CIS M365 7.0.0 (1.3.5)", "Security", "PhishingProtection"],
    "appliesToTest": ["CIS_1_3_5"],
    "helpText": "Enables internal phishing protection for Microsoft Forms to help prevent malicious forms from being created and shared within the organization. This feature scans forms created by internal users for potential phishing content and suspicious patterns.",
    "docsDescription": "Enables internal phishing protection for Microsoft Forms by setting the isInOrgFormsPhishingScanEnabled property to true. This security feature helps protect organizations from internal phishing attacks through Microsoft Forms by automatically scanning forms created by internal users for potential malicious content, suspicious links, and phishing patterns. When enabled, Forms will analyze form content and block or flag potentially dangerous forms before they can be shared within the organization.",
    "executiveText": "Automatically scans Microsoft Forms created by employees for malicious content and phishing attempts, preventing the creation and distribution of harmful forms within the organization. This protects against both internal threats and compromised accounts that might be used to distribute malicious content.",
    "addedComponent": [],
    "label": "Enable internal phishing protection for Forms",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-06-06",
    "powershellEquivalent": "Graph API",
    "recommendedBy": ["CIS", "CIPP"]
  },
  {
    "name": "standards.TAP",
    "cat": "Entra (AAD) Standards",
    "tag": [],
    "appliesToTest": ["EIDSCAAT01", "EIDSCAAT02", "ZTNA21845", "ZTNA21846"],
    "helpText": "Enables TAP and sets the default TAP lifetime to 1 hour. This configuration also allows you to select if a TAP is single use or multi-logon.",
    "docsDescription": "Enables Temporary Access Pass generation for the tenant.",
    "executiveText": "Enables temporary access passes that IT administrators can generate for employees who are locked out or need emergency access to systems. These time-limited passs provide a secure way to restore access without compromising long-term security policies.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "Select TAP Lifetime",
        "name": "standards.TAP.config",
        "options": [
          { "label": "Only Once", "value": "true" },
          { "label": "Multiple Logons", "value": "false" }
        ]
      }
    ],
    "label": "Enable Temporary Access Passes (TAP)",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2022-03-15",
    "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration",
    "recommendedBy": ["CIPP"]
  },
  {
    "name": "standards.PasswordExpireDisabled",
    "cat": "Entra (AAD) Standards",
    "tag": ["CIS M365 7.0.0 (1.3.1)", "PWAgePolicyNew"],
    "appliesToTest": ["CIS_1_3_1", "ZTNA21811"],
    "helpText": "Disables the expiration of passwords for the tenant by setting the password expiration policy to never expire for any user.",
    "docsDescription": "Sets passwords to never expire for tenant, recommended to use in conjunction with secure password requirements.",
    "executiveText": "Eliminates mandatory password expiration requirements, allowing employees to keep strong passwords indefinitely rather than forcing frequent changes that often lead to weaker passwords. This modern security approach reduces help desk calls and improves overall password security when combined with multi-factor authentication.",
    "addedComponent": [],
    "label": "Do not expire passwords",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2021-11-16",
    "powershellEquivalent": "Update-MgDomain",
    "recommendedBy": ["CIS", "CIPP"]
  },
  {
    "name": "standards.CustomBannedPasswordList",
    "cat": "Entra (AAD) Standards",
    "tag": ["CIS M365 7.0.0 (5.2.3.2)", "SMB1001 (2.1)"],
    "appliesToTest": [
      "CIS_5_2_3_2",
      "EIDSCAPR01",
      "EIDSCAPR02",
      "EIDSCAPR03",
      "EIDSCAPR05",
      "EIDSCAPR06",
      "SMB1001_2_1",
      "ZTNA21848",
      "ZTNA21849",
      "ZTNA21850"
    ],
    "helpText": "**Requires Entra ID P1.** Updates and enables the Entra ID custom banned password list with the supplied words. Enter words separated by commas or semicolons. Each word must be 4-16 characters long. Maximum 1,000 words allowed.",
    "docsDescription": "Updates and enables the Entra ID custom banned password list with the supplied words. This supplements the global banned password list maintained by Microsoft. The custom list is limited to 1,000 key base terms of 4-16 characters each. Entra ID will [block variations and common substitutions](https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-configure-custom-password-protection#configure-custom-banned-passwords) of these words in user passwords. [How are passwords evaluated?](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-password-ban-bad#score-calculation)",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.CustomBannedPasswordList.BannedWords",
        "label": "Banned Words",
        "placeholder": "Banned words separated by commas or semicolons",
        "required": true
      }
    ],
    "label": "Set Entra ID Custom Banned Password List",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2025-06-28",
    "powershellEquivalent": "Get-MgBetaDirectorySetting, New-MgBetaDirectorySetting, Update-MgBetaDirectorySetting",
    "recommendedBy": ["CIS"],
    "requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2"]
  },
  {
    "name": "standards.ExternalMFATrusted",
    "cat": "Entra (AAD) Standards",
    "tag": [],
    "appliesToTest": ["ZTNA21803", "ZTNA21804"],
    "helpText": "Sets the state of the Cross-tenant access setting to trust external MFA. This allows guest users to use their home tenant MFA to access your tenant.",
    "executiveText": "Allows external partners and vendors to use their own organization's multi-factor authentication when accessing company resources, streamlining collaboration while maintaining security standards. This reduces friction for external users while ensuring they still meet authentication requirements.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "Select value",
        "name": "standards.ExternalMFATrusted.state",
        "options": [
          { "label": "Enabled", "value": "true" },
          { "label": "Disabled", "value": "false" }
        ]
      }
    ],
    "label": "Sets the Cross-tenant access setting to trust external MFA",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-03-26",
    "powershellEquivalent": "Update-MgBetaPolicyCrossTenantAccessPolicyDefault",
    "recommendedBy": []
  },
  {
    "name": "standards.DisableTenantCreation",
    "cat": "Entra (AAD) Standards",
    "tag": ["CIS M365 7.0.0 (5.1.2.3)", "CISA (MS.AAD.6.1v1)", "SMB1001 (2.8)"],
    "appliesToTest": ["CIS_5_1_2_3", "SMB1001_2_8", "ZTNA21772", "ZTNA21787"],
    "helpText": "Restricts creation of M365 tenants to the Global Administrator or Tenant Creator roles.",
    "docsDescription": "Users by default are allowed to create M365 tenants. This disables that so only admins can create new M365 tenants.",
    "executiveText": "Prevents regular employees from creating new Microsoft 365 organizations, ensuring all new tenants are properly managed and controlled by IT administrators. This prevents unauthorized shadow IT environments and maintains centralized governance over Microsoft 365 resources.",
    "addedComponent": [],
    "label": "Disable M365 Tenant creation by users",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2022-11-29",
    "powershellEquivalent": "Update-MgPolicyAuthorizationPolicy",
    "recommendedBy": ["CIS", "CIPP"]
  },
  {
    "name": "standards.EnableAppConsentRequests",
    "cat": "Entra (AAD) Standards",
    "tag": [
      "CIS M365 7.0.0 (5.1.5.2)",
      "CISA (MS.AAD.9.1v1)",
      "EIDSCA.CP04",
      "EIDSCA.CR01",
      "EIDSCA.CR02",
      "EIDSCA.CR03",
      "EIDSCA.CR04",
      "Essential 8 (1507)",
      "NIST CSF 2.0 (PR.AA-05)"
    ],
    "appliesToTest": [
      "CIS_5_1_5_2",
      "EIDSCACP04",
      "EIDSCACR01",
      "EIDSCACR02",
      "EIDSCACR03",
      "EIDSCACR04",
      "ZTNA21809",
      "ZTNA21869"
    ],
    "helpText": "Enables App consent admin requests for the tenant via the GA role. Does not overwrite existing reviewer settings",
    "docsDescription": "Enables the ability for users to request admin consent for applications. Should be used in conjunction with the \"Require admin consent for applications\" standards",
    "executiveText": "Establishes a formal approval process where employees can request access to business applications that require administrative review. This balances security with productivity by allowing controlled access to necessary tools while preventing unauthorized application installations.",
    "addedComponent": [
      {
        "type": "AdminRolesMultiSelect",
        "label": "App Consent Reviewer Roles",
        "name": "standards.EnableAppConsentRequests.ReviewerRoles"
      }
    ],
    "label": "Enable App consent admin requests",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2023-11-27",
    "powershellEquivalent": "Update-MgPolicyAdminConsentRequestPolicy",
    "recommendedBy": ["CIS"]
  },
  {
    "name": "standards.NudgeMFA",
    "cat": "Entra (AAD) Standards",
    "tag": ["SMB1001 (2.5)"],
    "appliesToTest": ["SMB1001_2_5", "ZTNA21889"],
    "helpText": "Sets the state of the registration campaign for the tenant",
    "docsDescription": "Sets the state of the registration campaign for the tenant. If enabled nudges users to set up the Microsoft Authenticator during sign-in.",
    "executiveText": "Prompts employees to set up multi-factor authentication during login, gradually improving the organization's security posture by encouraging adoption of stronger authentication methods. This helps achieve better security compliance without forcing immediate mandatory changes.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "Select value",
        "name": "standards.NudgeMFA.state",
        "options": [
          { "label": "Enabled", "value": "enabled" },
          { "label": "Disabled", "value": "disabled" }
        ]
      },
      {
        "type": "number",
        "name": "standards.NudgeMFA.snoozeDurationInDays",
        "label": "Number of days to allow users to skip registering Authenticator (0-14, default is 1)",
        "defaultValue": 1,
        "validators": {
          "min": { "value": 0, "message": "Minimum value is 0" },
          "max": { "value": 14, "message": "Maximum value is 14" }
        }
      }
    ],
    "label": "Sets the state for the request to setup Authenticator",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2022-12-08",
    "powershellEquivalent": "Update-MgPolicyAuthenticationMethodPolicy",
    "recommendedBy": []
  },
  {
    "name": "standards.DisableM365GroupUsers",
    "cat": "Entra (AAD) Standards",
    "tag": ["CISA (MS.AAD.21.1v1)", "SMB1001 (2.8)"],
    "appliesToTest": ["SMB1001_2_8", "ZTNA21868"],
    "helpText": "Restricts M365 group creation to certain admin roles. This disables the ability to create Teams, SharePoint sites, Planner, etc",
    "docsDescription": "Users by default are allowed to create M365 groups. This restricts M365 group creation to certain admin roles. This disables the ability to create Teams, SharePoint sites, Planner, etc",
    "executiveText": "Restricts the creation of Microsoft 365 groups, Teams, and SharePoint sites to authorized administrators, preventing uncontrolled proliferation of collaboration spaces. This ensures proper governance, naming conventions, and resource management while maintaining oversight of all collaborative environments.",
    "addedComponent": [],
    "label": "Disable M365 Group creation by users",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2022-07-17",
    "powershellEquivalent": "Update-MgBetaDirectorySetting",
    "recommendedBy": [],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.DisableAppCreation",
    "cat": "Entra (AAD) Standards",
    "tag": [
      "CIS M365 7.0.0 (5.1.2.2)",
      "CISA (MS.AAD.4.1v1)",
      "EIDSCA.AP10",
      "Essential 8 (1175)",
      "NIST CSF 2.0 (PR.AA-05)",
      "SMB1001 (2.8)"
    ],
    "appliesToTest": ["CIS_5_1_2_2", "EIDSCAAP10", "SMB1001_2_8"],
    "helpText": "Disables the ability for users to create App registrations in the tenant.",
    "docsDescription": "Disables the ability for users to create applications in Entra. Done to prevent breached accounts from creating an app to maintain access to the tenant, even after the breached account has been secured.",
    "executiveText": "Prevents regular employees from creating application registrations that could be used to maintain unauthorized access to company systems. This security measure ensures that only authorized IT personnel can create applications, reducing the risk of persistent security breaches through malicious applications.",
    "addedComponent": [],
    "label": "Disable App creation by users",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-03-20",
    "powershellEquivalent": "Update-MgPolicyAuthorizationPolicy",
    "recommendedBy": ["CIS", "CIPP"]
  },
  {
    "name": "standards.BitLockerKeysForOwnedDevice",
    "cat": "Entra (AAD) Standards",
    "tag": ["CIS M365 7.0.0 (5.1.4.6)"],
    "appliesToTest": ["CIS_5_1_4_6", "ZTNA21954"],
    "helpText": "Controls whether standard users can recover BitLocker keys for devices they own.",
    "docsDescription": "Updates the Microsoft Entra authorization policy that controls whether standard users can read BitLocker recovery keys for devices they own. Choose to restrict access for tighter security or allow self-service recovery when operational needs require it.",
    "executiveText": "Gives administrators centralized control over BitLocker recovery secrets—restrict access to ensure IT-assisted recovery flows, or allow self-service when rapid device unlocks are a priority.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "Select state",
        "name": "standards.BitLockerKeysForOwnedDevice.state",
        "options": [
          { "label": "Restrict", "value": "restrict" },
          { "label": "Allow", "value": "allow" }
        ]
      }
    ],
    "label": "Control BitLocker key recovery for owned devices",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-10-12",
    "powershellEquivalent": "Update-MgBetaPolicyAuthorizationPolicy",
    "recommendedBy": []
  },
  {
    "name": "standards.DisableSecurityGroupUsers",
    "cat": "Entra (AAD) Standards",
    "tag": [
      "CIS M365 7.0.0 (5.1.3.1)",
      "CISA (MS.AAD.20.1v1)",
      "NIST CSF 2.0 (PR.AA-05)",
      "SMB1001 (2.8)"
    ],
    "appliesToTest": ["CIS_5_1_3_1", "SMB1001_2_8", "ZTNA21868"],
    "helpText": "Completely disables the creation of security groups by users. This also breaks the ability to manage groups themselves, or create Teams",
    "executiveText": "Restricts the creation of security groups to IT administrators only, preventing employees from creating unauthorized access groups that could bypass security controls. This ensures proper governance of access permissions and maintains centralized control over who can access what resources.",
    "addedComponent": [],
    "label": "Disable Security Group creation by users",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2022-07-17",
    "powershellEquivalent": "Update-MgBetaPolicyAuthorizationPolicy",
    "recommendedBy": []
  },
  {
    "name": "standards.LegacyMFACleanup",
    "cat": "Entra (AAD) Standards",
    "tag": [],
    "helpText": "This standard currently does not function and can be safely disabled",
    "executiveText": "This standard is currently non-functional and should be disabled. It was previously designed to remove outdated multi-factor authentication configurations in favor of modern security policies.",
    "addedComponent": [],
    "label": "Remove Legacy MFA if SD or CA is active",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2021-11-16",
    "powershellEquivalent": "Set-MsolUser -StrongAuthenticationRequirements $null",
    "recommendedBy": []
  },
  {
    "name": "standards.DisableSelfServiceLicenses",
    "cat": "Entra (AAD) Standards",
    "tag": ["CIS M365 7.0.0 (1.3.4)", "SMB1001 (2.8)"],
    "appliesToTest": ["CIS_1_3_4", "EIDSCAAP05", "SMB1001_2_8"],
    "helpText": "**Requires 'Billing Administrator' GDAP role.** This standard disables all self service licenses and enables all exclusions",
    "executiveText": "Prevents employees from purchasing Microsoft 365 licenses independently, ensuring all software acquisitions go through proper procurement channels. This maintains budget control, prevents unauthorized spending, and ensures compliance with corporate licensing agreements.",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.DisableSelfServiceLicenses.Exclusions",
        "label": "License Ids to exclude from this standard",
        "required": false
      },
      {
        "type": "switch",
        "name": "standards.DisableSelfServiceLicenses.DisableTrials",
        "label": "Disable starting trials on behalf of your organization"
      }
    ],
    "label": "Disable Self Service Licensing",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2021-11-16",
    "powershellEquivalent": "Set-MsolCompanySettings -AllowAdHocSubscriptions $false",
    "recommendedBy": []
  },
  {
    "name": "standards.DisableGuests",
    "cat": "Entra (AAD) Standards",
    "tag": ["SMB1001 (2.8)"],
    "appliesToTest": ["SMB1001_2_8", "ZTNA21858"],
    "helpText": "Blocks login for guest users that have not logged in for a number of days",
    "executiveText": "Automatically disables external guest accounts that haven't been used for a number of days, reducing security risks from dormant accounts while maintaining access for active external collaborators. This helps maintain a clean user directory and reduces potential attack vectors.",
    "addedComponent": [
      {
        "type": "number",
        "name": "standards.DisableGuests.days",
        "required": true,
        "defaultValue": 90,
        "label": "Days of inactivity"
      }
    ],
    "label": "Disable Guest accounts that have not logged on for a number of days",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2022-10-20",
    "powershellEquivalent": "Graph API",
    "recommendedBy": ["CIS", "CIPP"],
    "requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2"]
  },
  {
    "name": "standards.OauthConsent",
    "cat": "Entra (AAD) Standards",
    "tag": [
      "CIS M365 7.0.0 (5.1.5.1)",
      "CISA (MS.AAD.4.2v1)",
      "EIDSCA.AP08",
      "EIDSCA.AP09",
      "Essential 8 (1175)",
      "NIST CSF 2.0 (PR.AA-05)"
    ],
    "appliesToTest": [
      "CIS_5_1_5_1",
      "EIDSCAAP08",
      "EIDSCAAP09",
      "EIDSCACP01",
      "EIDSCACP03",
      "EIDSCACP04",
      "ZTNA21772",
      "ZTNA21774",
      "ZTNA21807",
      "ZTNA21810"
    ],
    "helpText": "Disables users from being able to consent to applications, except for those specified in the field below",
    "docsDescription": "Requires users to get administrator consent before sharing data with applications. You can preapprove specific applications.",
    "executiveText": "Requires administrative approval before employees can grant applications access to company data, preventing unauthorized data sharing and potential security breaches. This protects against malicious applications while allowing approved business tools to function normally.",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.OauthConsent.AllowedApps",
        "label": "Allowed application IDs, comma separated",
        "required": false
      }
    ],
    "label": "Require admin consent for applications (Prevent OAuth phishing)",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2021-11-16",
    "powershellEquivalent": "Update-MgPolicyAuthorizationPolicy",
    "recommendedBy": ["CIS", "CIPP"]
  },
  {
    "name": "standards.OauthConsentLowSec",
    "cat": "Entra (AAD) Standards",
    "tag": ["IntegratedApps"],
    "helpText": "Sets the default oauth consent level so users can consent to applications that have low risks.",
    "docsDescription": "Allows users to consent to applications with low assigned risk.",
    "executiveText": "Allows employees to approve low-risk applications without administrative intervention, balancing security with productivity. This provides a middle ground between complete restriction and open access, enabling business agility while maintaining protection against high-risk applications.",
    "label": "Allow users to consent to applications with low security risk (Prevent OAuth phishing. Lower impact, less secure)",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2022-08-16",
    "powershellEquivalent": "Update-MgPolicyAuthorizationPolicy",
    "recommendedBy": []
  },
  {
    "name": "standards.GuestInvite",
    "cat": "Entra (AAD) Standards",
    "tag": ["CISA (MS.AAD.18.1v1)", "EIDSCA.AP04", "EIDSCA.AP07", "SMB1001 (2.8)"],
    "appliesToTest": ["CIS_5_1_6_3", "EIDSCAAP04", "EIDSCAAP07", "SMB1001_2_8", "ZTNA21791"],
    "helpText": "This setting controls who can invite guests to your directory to collaborate on resources secured by your company, such as SharePoint sites or Azure resources.",
    "executiveText": "Controls who within the organization can invite external partners and vendors to access company resources, ensuring proper oversight of external access while enabling necessary business collaboration. This helps maintain security while supporting partnership and vendor relationships.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "required": true,
        "multiple": false,
        "creatable": false,
        "label": "Who can send invites?",
        "name": "standards.GuestInvite.allowInvitesFrom",
        "options": [
          { "label": "Everyone", "value": "everyone" },
          {
            "label": "Admins, Guest inviters and All Members",
            "value": "adminsGuestInvitersAndAllMembers"
          },
          { "label": "Admins and Guest inviters", "value": "adminsAndGuestInviters" },
          { "label": "None", "value": "none" }
        ]
      }
    ],
    "label": "Guest Invite setting",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2024-11-12",
    "powershellEquivalent": "Graph API",
    "recommendedBy": []
  },
  {
    "name": "standards.StaleEntraDevices",
    "cat": "Entra (AAD) Standards",
    "tag": ["Essential 8 (1501)", "NIST CSF 2.0 (ID.AM-08)", "NIST CSF 2.0 (PR.PS-03)"],
    "helpText": "**Remediate is currently not available**. Cleans up Entra devices that have not connected/signed in for the specified number of days.",
    "docsDescription": "Remediate is currently not available. Cleans up Entra devices that have not connected/signed in for the specified number of days. First disables and later deletes the devices. More info can be found in the [Microsoft documentation](https://learn.microsoft.com/en-us/entra/identity/devices/manage-stale-devices)",
    "executiveText": "Automatically identifies and removes inactive devices that haven't connected to company systems for a specified period, reducing security risks from abandoned or lost devices. This maintains a clean device inventory and prevents potential unauthorized access through dormant device registrations.",
    "addedComponent": [
      {
        "type": "number",
        "name": "standards.StaleEntraDevices.deviceAgeThreshold",
        "label": "Days before stale(Do not set below 30)",
        "validators": {
          "min": { "value": 30, "message": "Minimum value is 30" }
        }
      }
    ],
    "disabledFeatures": { "report": false, "warn": false, "remediate": true },
    "label": "Cleanup stale Entra devices",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2025-01-19",
    "powershellEquivalent": "Remove-MgDevice, Update-MgDevice or Graph API",
    "recommendedBy": [],
    "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"]
  },
  {
    "name": "standards.UndoOauth",
    "cat": "Entra (AAD) Standards",
    "tag": [],
    "helpText": "Disables App consent and set to Allow user consent for apps",
    "executiveText": "Reverses application consent restrictions, allowing employees to approve applications independently without administrative oversight. This increases productivity and user autonomy but reduces security controls over data access permissions.",
    "addedComponent": [],
    "label": "Undo App Consent Standard",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2022-01-07",
    "powershellEquivalent": "Update-MgPolicyAuthorizationPolicy",
    "recommendedBy": []
  },
  {
    "name": "standards.SecurityDefaults",
    "cat": "Entra (AAD) Standards",
    "tag": ["CISA (MS.AAD.11.1v1)", "SMB1001 (2.5)", "SMB1001 (2.6)", "SMB1001 (2.9)"],
    "appliesToTest": ["SMB1001_2_5", "SMB1001_2_6", "SMB1001_2_9", "ZTNA21843"],
    "helpText": "Enables security defaults for the tenant, for newer tenants this is enabled by default. Do not enable this feature if you use Conditional Access.",
    "docsDescription": "Enables SD for the tenant, which disables all forms of basic authentication and enforces users to configure MFA. Users are only prompted for MFA when a logon is considered 'suspect' by Microsoft.",
    "executiveText": "Activates Microsoft's baseline security configuration that requires multi-factor authentication and blocks legacy authentication methods. This provides essential security protection for organizations without complex conditional access policies, significantly improving security posture with minimal configuration.",
    "addedComponent": [],
    "label": "Enable Security Defaults",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2021-11-19",
    "powershellEquivalent": "[Read more here](https://www.cyberdrain.com/automating-with-powershell-enabling-secure-defaults-and-sd-explained/)",
    "recommendedBy": []
  },
  {
    "name": "standards.DisableSMS",
    "cat": "Entra (AAD) Standards",
    "tag": [
      "CIS M365 7.0.0 (5.2.3.5)",
      "EIDSCA.AS04",
      "NIST CSF 2.0 (PR.AA-03)",
      "SMB1001 (2.5)",
      "SMB1001 (2.6)",
      "SMB1001 (2.9)"
    ],
    "appliesToTest": [
      "CIS_5_2_3_5",
      "EIDSCAAS04",
      "SMB1001_2_5",
      "SMB1001_2_5_L4",
      "SMB1001_2_6",
      "SMB1001_2_9"
    ],
    "helpText": "This blocks users from using SMS as an MFA method. If a user only has SMS as a MFA method, they will be unable to log in.",
    "docsDescription": "Disables SMS as an MFA method for the tenant. If a user only has SMS as a MFA method, they will be unable to sign in.",
    "executiveText": "Disables SMS text messages as a multi-factor authentication method due to security vulnerabilities like SIM swapping attacks. This forces users to adopt more secure authentication methods like authenticator apps or hardware tokens, significantly improving account security.",
    "addedComponent": [],
    "label": "Disables SMS as an MFA method",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2023-12-18",
    "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration",
    "recommendedBy": ["CIPP"]
  },
  {
    "name": "standards.DisableVoice",
    "cat": "Entra (AAD) Standards",
    "tag": [
      "CIS M365 7.0.0 (5.2.3.5)",
      "EIDSCA.AV01",
      "NIST CSF 2.0 (PR.AA-03)",
      "SMB1001 (2.5)",
      "SMB1001 (2.6)",
      "SMB1001 (2.9)"
    ],
    "appliesToTest": [
      "CIS_5_2_3_5",
      "EIDSCAAV01",
      "SMB1001_2_5",
      "SMB1001_2_5_L4",
      "SMB1001_2_6",
      "SMB1001_2_9"
    ],
    "helpText": "This blocks users from using Voice call as an MFA method. If a user only has Voice as a MFA method, they will be unable to log in.",
    "docsDescription": "Disables Voice call as an MFA method for the tenant. If a user only has Voice call as a MFA method, they will be unable to sign in.",
    "executiveText": "Disables voice call authentication due to security vulnerabilities and social engineering risks. This forces users to adopt more secure authentication methods like authenticator apps, improving overall account security by eliminating phone-based attack vectors.",
    "addedComponent": [],
    "label": "Disables Voice call as an MFA method",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2023-12-18",
    "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration",
    "recommendedBy": ["CIPP"]
  },
  {
    "name": "standards.DisableEmail",
    "cat": "Entra (AAD) Standards",
    "tag": [
      "CIS M365 7.0.0 (5.2.3.7)",
      "NIST CSF 2.0 (PR.AA-03)",
      "SMB1001 (2.5)",
      "SMB1001 (2.6)",
      "SMB1001 (2.9)"
    ],
    "appliesToTest": ["CIS_5_2_3_7", "SMB1001_2_5", "SMB1001_2_5_L4", "SMB1001_2_6", "SMB1001_2_9"],
    "helpText": "This blocks users from using email as an MFA method. This disables the email OTP option for guest users, and instead prompts them to create a Microsoft account.",
    "executiveText": "Disables email-based authentication codes due to security concerns with email interception and account compromise. This forces users to adopt more secure authentication methods, particularly affecting guest users who must use stronger verification methods.",
    "addedComponent": [],
    "label": "Disables Email as an MFA method",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2023-12-18",
    "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration",
    "recommendedBy": []
  },
  {
    "name": "standards.EmailAsAlternateLoginId",
    "cat": "Entra (AAD) Standards",
    "tag": [],
    "helpText": "Configures the tenant-wide Email as alternate login ID setting in Home Realm Discovery policy. Enabling this can help during migrations, if users are changing UPN.",
    "docsDescription": "Sets the Home Realm Discovery policy AlternateIdLogin setting to enable or disable using email as an alternate sign-in ID.",
    "executiveText": "Controls whether users can sign in with email as an alternate identifier, allowing organizations to align sign-in behavior with their identity strategy and reduce authentication ambiguity.",
    "addedComponent": [
      {
        "type": "switch",
        "name": "standards.EmailAsAlternateLoginId.Enabled",
        "label": "Enable Email as Alternate Login ID",
        "defaultValue": true
      }
    ],
    "label": "Configure Email as alternate login ID",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2026-06-03",
    "powershellEquivalent": "Invoke-MgGraphRequest https://graph.microsoft.com/v1.0/policies/homeRealmDiscoveryPolicies/",
    "recommendedBy": ["CIPP"]
  },
  {
    "name": "standards.Disablex509Certificate",
    "cat": "Entra (AAD) Standards",
    "tag": [],
    "helpText": "This blocks users from using Certificates as an MFA method.",
    "docsDescription": "",
    "executiveText": "Disables certificate-based authentication as a multi-factor authentication method, typically used when organizations want to standardize on other authentication methods or when certificate management becomes too complex for the security benefit provided.",
    "addedComponent": [],
    "label": "Disables Certificates as an MFA method",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2023-12-18",
    "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration",
    "recommendedBy": []
  },
  {
    "name": "standards.DisableQRCodePin",
    "cat": "Entra (AAD) Standards",
    "tag": [],
    "helpText": "This blocks users from using QR Code Pin as an MFA method. If a user only has QR Code Pin as a MFA method, they will be unable to log in.",
    "docsDescription": "Disables QR Code Pin as an MFA method for the tenant. If a user only has QR Code Pin as a MFA method, they will be unable to sign in.",
    "executiveText": "Disables QR Code Pin authentication method due to security concerns, forcing users to adopt more secure authentication alternatives. This helps standardize authentication methods and reduces potential security vulnerabilities while ensuring employees use more robust multi-factor authentication options.",
    "addedComponent": [],
    "label": "Disables QR Code Pin as an MFA method",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2024-02-10",
    "powershellEquivalent": "Update-MgBetaPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration",
    "recommendedBy": []
  },
  {
    "name": "standards.PerUserMFA",
    "cat": "Entra (AAD) Standards",
    "tag": [
      "CISA (MS.AAD.1.1v1)",
      "CISA (MS.AAD.1.2v1)",
      "Essential 8 (1504)",
      "Essential 8 (1173)",
      "Essential 8 (1401)",
      "NIST CSF 2.0 (PR.AA-03)",
      "SMB1001 (2.5)",
      "SMB1001 (2.6)",
      "SMB1001 (2.9)"
    ],
    "appliesToTest": [
      "SMB1001_2_5",
      "SMB1001_2_6",
      "SMB1001_2_9",
      "ZTNA21780",
      "ZTNA21782",
      "ZTNA21796"
    ],
    "helpText": "Enables per user MFA for all users.",
    "executiveText": "Requires all employees to use multi-factor authentication for enhanced account security, significantly reducing the risk of unauthorized access from compromised passwords. This fundamental security measure protects against the majority of account-based attacks and is essential for maintaining strong cybersecurity posture.",
    "addedComponent": [],
    "label": "Enables per user MFA for all users.",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2024-06-14",
    "powershellEquivalent": "Graph API",
    "recommendedBy": []
  },
  {
    "name": "standards.UserPreferredLanguage",
    "cat": "Entra (AAD) Standards",
    "tag": [],
    "helpText": "Sets the preferred language property for all users in the tenant. This will override the user's language settings.",
    "docsDescription": "Sets the preferred language property for all users in the tenant. This will override the user's language settings.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "name": "standards.UserPreferredLanguage.preferredLanguage",
        "label": "Preferred Language",
        "api": { "url": "/languageList.json", "labelField": "tag", "valueField": "tag" }
      }
    ],
    "label": "Preferred language for all users",
    "impact": "High Impact",
    "impactColour": "info",
    "addedDate": "2025-02-26",
    "powershellEquivalent": "Update-MgUser -UserId user@domain.com -BodyParameter @{preferredLanguage='en-US'}",
    "recommendedBy": []
  },
  {
    "name": "standards.AppManagementPolicy",
    "cat": "Entra (AAD) Standards",
    "tag": ["CIS M365 7.0.0 (5.1.5.3)", "CIS M365 7.0.0 (5.1.5.4)", "CIS M365 7.0.0 (5.1.5.5)", "CIS M365 7.0.0 (5.1.5.6)"],
    "appliesToTest": ["CIS_5_1_5_3", "CIS_5_1_5_4", "CIS_5_1_5_5", "CIS_5_1_5_6", "ZTNA21773", "ZTNA21896", "ZTNA21992"],
    "helpText": "Configures the default app management policy to control application and service principal credential restrictions such as password and key credential lifetimes.",
    "docsDescription": "Configures the default app management policy to control application and service principal credential restrictions. This includes password addition restrictions, custom password addition, symmetric key addition, and credential lifetime limits for both applications and service principals.",
    "executiveText": "Enforces credential restrictions on application registrations and service principals to limit how secrets and certificates are created and how long they remain valid. This reduces the risk of long-lived or unmanaged credentials being used to access your tenant.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "required": false,
        "name": "standards.AppManagementPolicy.passwordCredentialsPasswordAddition",
        "label": "Disable Password Addition",
        "options": [
          { "label": "Enabled", "value": "enabled" },
          { "label": "Disabled", "value": "disabled" }
        ]
      },
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "required": false,
        "name": "standards.AppManagementPolicy.passwordCredentialsCustomPasswordAddition",
        "label": "Disable Custom Password",
        "options": [
          { "label": "Enabled", "value": "enabled" },
          { "label": "Disabled", "value": "disabled" }
        ]
      },
      {
        "type": "number",
        "required": false,
        "name": "standards.AppManagementPolicy.passwordCredentialsMaxLifetime",
        "label": "Password Credentials Max Lifetime (Days)"
      },
      {
        "type": "number",
        "required": false,
        "name": "standards.AppManagementPolicy.keyCredentialsMaxLifetime",
        "label": "Key Credentials Max Lifetime (Days)"
      }
    ],
    "label": "Set Default App Management Policy",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2026-03-13",
    "powershellEquivalent": "Graph API",
    "recommendedBy": []
  },
  {
    "name": "standards.OutBoundSpamAlert",
    "cat": "Exchange Standards",
    "tag": ["CIS M365 7.0.0 (2.1.6)"],
    "appliesToTest": ["CIS_2_1_6"],
    "helpText": "Set the Outbound Spam Alert e-mail address",
    "docsDescription": "Sets the e-mail address to which outbound spam alerts are sent.",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.OutBoundSpamAlert.OutboundSpamContact",
        "label": "Outbound spam contact"
      }
    ],
    "label": "Set Outbound Spam Alert e-mail",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2023-05-03",
    "powershellEquivalent": "Set-HostedOutboundSpamFilterPolicy",
    "recommendedBy": ["CIS"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.MessageExpiration",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Sets the transport message configuration to timeout a message at 12 hours.",
    "docsDescription": "Expires messages in the transport queue after 12 hours. Makes the NDR for failed messages show up faster for users. Default is 24 hours.",
    "addedComponent": [],
    "label": "Lower Transport Message Expiration to 12 hours",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-02-23",
    "powershellEquivalent": "Set-TransportConfig -MessageExpirationTimeout 12.00:00:00",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.GlobalQuarantineNotifications",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Sets the Global Quarantine Notification Interval to the selected value. Determines how often the quarantine notification is sent to users.",
    "docsDescription": "Sets the global quarantine notification interval for the tenant. This is the time between the quarantine notification emails are sent out to users. Default is 24 hours.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "label": "Select value",
        "name": "standards.GlobalQuarantineNotifications.NotificationInterval",
        "options": [
          { "label": "4 hours", "value": "04:00:00" },
          { "label": "1 day/Daily", "value": "1.00:00:00" },
          { "label": "7 days/Weekly", "value": "7.00:00:00" }
        ]
      }
    ],
    "label": "Set Global Quarantine Notification Interval",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-05-03",
    "powershellEquivalent": "Set-QuarantinePolicy -EndUserSpamNotificationFrequency",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.DisableTNEF",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Disables Transport Neutral Encapsulation Format (TNEF)/winmail.dat for the tenant. TNEF can cause issues if the recipient is not using a client supporting TNEF.",
    "docsDescription": "Disables Transport Neutral Encapsulation Format (TNEF)/winmail.dat for the tenant. TNEF can cause issues if the recipient is not using a client supporting TNEF. Cannot be overridden by the user. For more information, see [Microsoft's documentation.](https://learn.microsoft.com/en-us/exchange/mail-flow/content-conversion/tnef-conversion?view=exchserver-2019)",
    "executiveText": "Prevents the creation of winmail.dat attachments that can cause compatibility issues when sending emails to external recipients using non-Outlook email clients. This improves email compatibility and reduces support issues with external partners and customers.",
    "addedComponent": [],
    "label": "Disable TNEF/winmail.dat",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-04-26",
    "powershellEquivalent": "Set-RemoteDomain -Identity 'Default' -TNEFEnabled $false",
    "recommendedBy": ["CIPP"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.FocusedInbox",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Sets the default Focused Inbox state for the tenant. This can be overridden by the user.",
    "docsDescription": "Sets the default Focused Inbox state for the tenant. This can be overridden by the user in their Outlook settings. For more information, see [Microsoft's documentation.](https://support.microsoft.com/en-us/office/focused-inbox-for-outlook-f445ad7f-02f4-4294-a82e-71d8964e3978)",
    "executiveText": "Configures the default setting for Outlook's Focused Inbox feature, which automatically sorts important emails into a focused view while placing less important emails in a separate section. This can improve employee productivity by reducing email clutter, though users can adjust this setting individually.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "label": "Select value",
        "name": "standards.FocusedInbox.state",
        "options": [
          { "label": "Enabled", "value": "enabled" },
          { "label": "Disabled", "value": "disabled" }
        ]
      }
    ],
    "label": "Set Focused Inbox state",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-04-26",
    "powershellEquivalent": "Set-OrganizationConfig -FocusedInboxOn $true or $false",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.CloudMessageRecall",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Sets the Cloud Message Recall state for the tenant. This allows users to recall messages from the cloud.",
    "docsDescription": "Sets the default state for Cloud Message Recall for the tenant. By default this is enabled. You can read more about the feature [here.](https://techcommunity.microsoft.com/t5/exchange-team-blog/cloud-based-message-recall-in-exchange-online/ba-p/3744714)",
    "executiveText": "Enables employees to recall or retract emails they've sent, helping prevent embarrassing mistakes or accidental data sharing. This feature can reduce the impact of human errors in email communication and provides a safety net for sensitive information accidentally sent to wrong recipients.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "label": "Select value",
        "name": "standards.CloudMessageRecall.state",
        "options": [
          { "label": "Enabled", "value": "true" },
          { "label": "Disabled", "value": "false" }
        ]
      }
    ],
    "label": "Set Cloud Message Recall state",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-05-31",
    "powershellEquivalent": "Set-OrganizationConfig -MessageRecallEnabled",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.AutoExpandArchive",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Enables auto-expanding archives for the tenant",
    "docsDescription": "Enables auto-expanding archives for the tenant. Does not enable archives for users.",
    "executiveText": "Enables automatic expansion of email archive storage when users approach their archive limits, ensuring continuous email retention without manual intervention. This prevents email storage issues and maintains compliance with data retention policies without requiring ongoing administrative management.",
    "addedComponent": [],
    "label": "Enable Auto-expanding archives",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2021-11-16",
    "powershellEquivalent": "Set-OrganizationConfig -AutoExpandingArchive",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.TwoClickEmailProtection",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Configures the two-click confirmation requirement for viewing encrypted/protected emails in OWA and new Outlook. When enabled, users must click \"View message\" before accessing protected content, providing an additional layer of privacy protection.",
    "docsDescription": "Configures the TwoClickMailPreviewEnabled setting in Exchange Online organization configuration. This security feature requires users to click \"View message\" before accessing encrypted or protected emails in Outlook on the web (OWA) and new Outlook for Windows. This provides additional privacy protection by preventing protected content from automatically displaying, giving users time to ensure their screen is not visible to others before viewing sensitive content. The feature helps protect against shoulder surfing and accidental disclosure of confidential information.",
    "executiveText": "Requires employees to click twice before viewing encrypted or sensitive emails, preventing accidental exposure of confidential information when screens might be visible to others. This privacy protection helps prevent shoulder surfing and ensures employees are intentional about viewing sensitive content.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "Select value",
        "name": "standards.TwoClickEmailProtection.state",
        "options": [
          { "label": "Enabled", "value": "enabled" },
          { "label": "Disabled", "value": "disabled" }
        ]
      }
    ],
    "label": "Set two-click confirmation for encrypted emails in New Outlook",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-06-13",
    "powershellEquivalent": "Set-OrganizationConfig -TwoClickMailPreviewEnabled $true | $false",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.EnableOnlineArchiving",
    "cat": "Exchange Standards",
    "tag": ["Essential 8 (1511)", "NIST CSF 2.0 (PR.DS-11)", "SMB1001 (3.1)"],
    "appliesToTest": ["SMB1001_3_1"],
    "helpText": "Enables the In-Place Online Archive for all UserMailboxes with a valid license.",
    "executiveText": "Automatically enables online email archiving for all licensed employees, providing additional storage for older emails while maintaining easy access. This helps manage mailbox sizes, improves email performance, and supports compliance with data retention requirements.",
    "addedComponent": [],
    "label": "Enable Online Archive for all users",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-01-20",
    "powershellEquivalent": "Enable-Mailbox -Archive $true",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.EnableLitigationHold",
    "cat": "Exchange Standards",
    "tag": ["SMB1001 (3.1)"],
    "appliesToTest": ["SMB1001_3_1"],
    "helpText": "Enables litigation hold for all UserMailboxes with a valid license.",
    "executiveText": "Preserves all email content for legal and compliance purposes by preventing permanent deletion of emails, even when users attempt to delete them. This is essential for organizations subject to legal discovery requirements or regulatory compliance mandates.",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.EnableLitigationHold.days",
        "required": false,
        "label": "Days to apply for litigation hold",
        "helperText": "Number of days to apply litigation hold for. If left blank or set to Unlimited, litigation hold will be applied indefinitely."
      }
    ],
    "label": "Enable Litigation Hold for all users",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-06-25",
    "powershellEquivalent": "Set-Mailbox -LitigationHoldEnabled $true",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.SpoofWarn",
    "cat": "Exchange Standards",
    "tag": ["CIS M365 7.0.0 (6.2.3)"],
    "appliesToTest": ["CISAMSEXO71", "CIS_6_2_3", "ORCA111", "ORCA240"],
    "helpText": "Adds or removes indicators to e-mail messages received from external senders in Outlook. Works on all Outlook clients/OWA",
    "docsDescription": "Adds or removes indicators to e-mail messages received from external senders in Outlook. You can read more about this feature on [Microsoft's Exchange Team Blog.](https://techcommunity.microsoft.com/t5/exchange-team-blog/native-external-sender-callouts-on-email-in-outlook/ba-p/2250098)",
    "executiveText": "Displays visual warnings in Outlook when emails come from external senders, helping employees identify potentially suspicious messages and reducing the risk of phishing attacks. This security feature makes it easier for staff to distinguish between internal and external communications.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "label": "Select value",
        "name": "standards.SpoofWarn.state",
        "options": [
          { "label": "Enabled", "value": "enabled" },
          { "label": "Disabled", "value": "disabled" }
        ]
      },
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": true,
        "required": false,
        "label": "Enter allowed senders(domain.com, *.domain.com or test@domain.com)",
        "name": "standards.SpoofWarn.AllowListAdd"
      }
    ],
    "label": "Enable or disable 'external' warning in Outlook",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2021-11-16",
    "powershellEquivalent": "Set-ExternalInOutlook –Enabled $true or $false",
    "recommendedBy": ["CIS", "CIPP"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.EnableMailTips",
    "cat": "Exchange Standards",
    "tag": ["CIS M365 7.0.0 (6.5.2)", "exo_mailtipsenabled"],
    "appliesToTest": ["CIS_6_5_2"],
    "helpText": "Enables all MailTips in Outlook. MailTips are the notifications Outlook and Outlook on the web shows when an email you create, meets some requirements",
    "executiveText": "Enables helpful notifications in Outlook that warn users about potential email issues, such as sending to large groups, external recipients, or invalid addresses. This reduces email mistakes and improves communication efficiency by providing real-time guidance to employees.",
    "addedComponent": [
      {
        "type": "number",
        "name": "standards.EnableMailTips.MailTipsLargeAudienceThreshold",
        "label": "Number of recipients to trigger the large audience MailTip (Default is 25)",
        "placeholder": "Enter a profile name",
        "defaultValue": 25
      }
    ],
    "label": "Enable all MailTips",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-01-14",
    "powershellEquivalent": "Set-OrganizationConfig",
    "recommendedBy": ["CIS", "CIPP"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.TeamsMeetingsByDefault",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Sets the default state for automatically turning meetings into Teams meetings for the tenant. This can be overridden by the user in Outlook.",
    "executiveText": "Automatically adds Microsoft Teams meeting links to calendar invitations by default, streamlining the process of creating virtual meetings. This improves collaboration efficiency and ensures consistent meeting experiences across the organization, though users can override this setting when needed.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "Select value",
        "name": "standards.TeamsMeetingsByDefault.state",
        "options": [
          { "label": "Enabled", "value": "true" },
          { "label": "Disabled", "value": "false" }
        ]
      }
    ],
    "label": "Set Teams Meetings by default state",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-05-31",
    "powershellEquivalent": "Set-OrganizationConfig -OnlineMeetingsByDefaultEnabled",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.DisableViva",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Disables the daily viva reports for all users. This standard requires the CIPP-SAM application to have the Company Administrator (Global Admin) role in the tenant. Enable this using CIPP > Advanced > Super Admin > SAM App Roles. Activate the roles with a CPV refresh.",
    "docsDescription": "",
    "executiveText": "Disables daily Microsoft Viva Insights reports that are automatically sent to employees, reducing email volume and allowing organizations to control when and how productivity insights are shared. This can help prevent information overload while maintaining the ability to access insights when needed.",
    "addedComponent": [],
    "label": "Disable daily Insight/Viva reports",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2022-05-25",
    "powershellEquivalent": "Set-UserBriefingConfig",
    "recommendedBy": []
  },
  {
    "name": "standards.RotateDKIM",
    "cat": "Exchange Standards",
    "tag": ["CIS M365 7.0.0 (2.1.9)", "SMB1001 (2.12)"],
    "appliesToTest": ["CIS_2_1_9", "SMB1001_2_12"],
    "helpText": "Rotate DKIM keys that are 1024 bit to 2048 bit",
    "executiveText": "Upgrades email security by replacing older 1024-bit encryption keys with stronger 2048-bit keys for email authentication. This improves the organization's email security posture and helps prevent email spoofing and tampering, maintaining trust with email recipients.",
    "addedComponent": [],
    "label": "Rotate DKIM keys that are 1024 bit to 2048 bit",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2023-03-14",
    "powershellEquivalent": "Rotate-DkimSigningConfig",
    "recommendedBy": ["CIS", "CIPP"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.EnableExchangeCloudManagement",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Configures cloud-based management of Exchange attributes for directory-synced users with remote mailboxes in Exchange Online. This allows you to enable or disable management of Exchange attributes directly in the cloud without requiring an on-premises Exchange server. More information can be found [here](https://learn.microsoft.com/da-dk/exchange/hybrid-deployment/enable-exchange-attributes-cloud-management).",
    "docsDescription": "Configures the IsExchangeCloudManaged property for mailboxes, allowing Exchange attributes (aliases, mailbox flags, custom attributes, etc.) to be managed directly in Exchange Online or revert back to on-premises management. This feature helps organizations retire their last on-premises Exchange server in hybrid deployments while maintaining the ability to manage recipient attributes. Identity attributes (names, UPN) remain managed on-premises via Active Directory. More information can be found [here](https://learn.microsoft.com/da-dk/exchange/hybrid-deployment/enable-exchange-attributes-cloud-management).",
    "executiveText": "Configures cloud-based management of Exchange mailbox attributes for hybrid organizations. When enabled, eliminates the dependency on on-premises Exchange servers for attribute management. This modernizes email administration, reduces infrastructure complexity, and allows direct management of mailbox properties through cloud portals and PowerShell. When disabled, returns management to on-premises Exchange servers.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "name": "standards.EnableExchangeCloudManagement.state",
        "label": "Cloud Management State",
        "options": [
          { "label": "Cloud Management", "value": true },
          { "label": "On-Premises Management", "value": false }
        ]
      }
    ],
    "label": "Configure Exchange Cloud Management for Remote/On-Premises Mailboxes",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2026-03-28",
    "powershellEquivalent": "Set-Mailbox -Identity user@domain.com -IsExchangeCloudManaged $true or $false",
    "recommendedBy": ["Microsoft", "CIPP"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV"
    ]
  },
  {
    "name": "standards.AddDKIM",
    "cat": "Exchange Standards",
    "tag": ["CIS M365 7.0.0 (2.1.9)", "SMB1001 (2.12)"],
    "appliesToTest": ["CISAMSEXO31", "CIS_2_1_9", "ORCA108", "ORCA108_1", "SMB1001_2_12"],
    "helpText": "Enables DKIM for all domains that currently support it",
    "executiveText": "Enables email authentication technology that digitally signs outgoing emails to verify they actually came from your organization. This prevents email spoofing, improves email deliverability, and protects the company's reputation by ensuring recipients can trust emails from your domains.",
    "addedComponent": [],
    "label": "Enables DKIM for all domains that currently support it",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2023-03-14",
    "powershellEquivalent": "New-DkimSigningConfig and Set-DkimSigningConfig",
    "recommendedBy": ["CIS", "CIPP"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.AddDMARCToMOERA",
    "cat": "Global Standards",
    "tag": ["CIS M365 7.0.0 (2.1.10)", "Security", "PhishingProtection", "SMB1001 (2.12)"],
    "appliesToTest": ["CIS_2_1_10", "SMB1001_2_12"],
    "helpText": "** Remediation is not available ** Note: requires 'Domain Name Administrator' GDAP role. This should be enabled even if the MOERA (onmicrosoft.com) domains is not used for sending. Enabling this prevents email spoofing. The default value is 'v=DMARC1; p=reject;' recommended because the domain is only used within M365 and reporting is not needed. Omitting pct tag default to 100%",
    "docsDescription": "** Remediation is not available ** Note: requires 'Domain Name Administrator' GDAP role. Adds a DMARC record to MOERA (onmicrosoft.com) domains. This should be enabled even if the MOERA (onmicrosoft.com) domains is not used for sending. Enabling this prevents email spoofing. The default record is 'v=DMARC1; p=reject;' recommended because the domain is only used within M365 and reporting is not needed. Omitting pct tag default to 100%",
    "executiveText": "Implements advanced email security for Microsoft's default domain names (onmicrosoft.com) to prevent criminals from impersonating your organization. This blocks fraudulent emails that could damage your company's reputation and protects partners and customers from phishing attacks using your domain names.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": true,
        "required": false,
        "placeholder": "v=DMARC1; p=reject; (recommended)",
        "label": "Value",
        "name": "standards.AddDMARCToMOERA.RecordValue",
        "options": [
          { "label": "v=DMARC1; p=reject; (recommended)", "value": "v=DMARC1; p=reject;" }
        ]
      }
    ],
    "label": "Enables DMARC on MOERA (onmicrosoft.com) domains",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-06-16",
    "powershellEquivalent": "Portal only",
    "recommendedBy": ["CIS", "Microsoft"],
    "disabledFeatures": { "remediate": true }
  },
  {
    "name": "standards.EnableMailboxAuditing",
    "cat": "Exchange Standards",
    "tag": [
      "CIS M365 7.0.0 (6.1.1)",
      "CIS M365 7.0.0 (6.1.2)",
      "CIS M365 7.0.0 (6.1.3)",
      "exo_mailboxaudit",
      "Essential 8 (1509)",
      "Essential 8 (1683)",
      "NIST CSF 2.0 (DE.CM-09)"
    ],
    "appliesToTest": ["CISAMSEXO131", "CIS_6_1_1", "CIS_6_1_2", "CIS_6_1_3"],
    "helpText": "Enables Mailbox auditing for all mailboxes and on tenant level. Disables audit bypass on all mailboxes. Unified Audit Log needs to be enabled for this standard to function.",
    "docsDescription": "Enables mailbox auditing on tenant level and for all mailboxes. Disables audit bypass on all mailboxes. By default Microsoft does not enable mailbox auditing for Resource Mailboxes, Public Folder Mailboxes and DiscoverySearch Mailboxes. Unified Audit Log needs to be enabled for this standard to function.",
    "executiveText": "Enables comprehensive logging of all email access and modifications across all employee mailboxes, providing detailed audit trails for security investigations and compliance requirements. This helps detect unauthorized access, data breaches, and supports regulatory compliance efforts.",
    "addedComponent": [],
    "label": "Enable Mailbox auditing",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-01-08",
    "powershellEquivalent": "Set-OrganizationConfig -AuditDisabled $false",
    "recommendedBy": ["CIS", "CIPP"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.AutoArchive",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Configures the auto-archiving threshold percentage for the tenant. When a mailbox exceeds this threshold, the oldest items are automatically moved to the archive mailbox. Archive must be enabled manually or via the CIPP standard 'Enable Online Archive for all users'. More information can be found in [Microsoft's documentation.](https://learn.microsoft.com/en-us/exchange/security-and-compliance/messaging-records-management/auto-archiving)",
    "docsDescription": "Configures the auto-archiving threshold at the organization level. Auto-archiving automatically moves the oldest items from a user's primary mailbox to their archive mailbox when mailbox usage exceeds the configured threshold percentage. This prevents mail flow disruptions caused by full mailboxes. Valid range is 80-100, where 100 disables auto-archiving for the tenant. More information can be found in [Microsoft's documentation.](https://learn.microsoft.com/en-us/exchange/security-and-compliance/messaging-records-management/auto-archiving)",
    "executiveText": "Configures automatic archiving of mailbox items when storage approaches capacity, preventing email delivery failures due to full mailboxes. This proactive storage management ensures business continuity and reduces helpdesk tickets related to mailbox quota issues.",
    "addedComponent": [
      {
        "type": "number",
        "name": "standards.AutoArchive.AutoArchivingThresholdPercentage",
        "label": "Auto-Archiving Threshold Percentage (80-100, default 96, 100 disables)",
        "defaultValue": 96,
        "validators": {
          "min": { "value": 80, "message": "Minimum value is 80" },
          "max": { "value": 100, "message": "Maximum value is 100" }
        }
      }
    ],
    "label": "Configure Auto-Archiving Threshold",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-12-11",
    "powershellEquivalent": "Set-OrganizationConfig -AutoArchivingThresholdPercentage 80-100",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.AutoArchiveMailbox",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Enables or disables the tenant policy that automatically provisions an archive mailbox when a user's primary mailbox reaches 90% of its quota.",
    "docsDescription": "Enables or disables the tenant policy that automatically provisions an archive mailbox when a user's primary mailbox reaches 90% of its quota. This is separate from auto-archiving thresholds and does not enable archives for all users immediately.",
    "executiveText": "Automatically provisions archive mailboxes only when users reach 90% of their mailbox capacity, reducing manual intervention and preventing mailbox quota issues without enabling archives for everyone.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "Select value",
        "name": "standards.AutoArchiveMailbox.state",
        "options": [
          { "label": "Enabled", "value": "enabled" },
          { "label": "Disabled", "value": "disabled" }
        ]
      }
    ],
    "label": "Set auto enable archive mailbox state",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2026-01-16",
    "powershellEquivalent": "Set-OrganizationConfig -AutoEnableArchiveMailbox $true|$false",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.SendReceiveLimitTenant",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Sets the Send and Receive limits for new users. Valid values are 1MB to 150MB",
    "executiveText": "Establishes standard email attachment size limits for all new employees, balancing functionality with system performance and security. This prevents email system overload from large attachments while ensuring employees can share necessary files through appropriate channels.",
    "addedComponent": [
      {
        "type": "number",
        "name": "standards.SendReceiveLimitTenant.SendLimit",
        "label": "Send limit in MB (Default is 35)",
        "defaultValue": 35,
        "validators": {
          "min": { "value": 1, "message": "Minimum value is 1" },
          "max": { "value": 150, "message": "Maximum value is 150" }
        }
      },
      {
        "type": "number",
        "name": "standards.SendReceiveLimitTenant.ReceiveLimit",
        "label": "Receive Limit in MB (Default is 36)",
        "defaultValue": 36,
        "validators": {
          "min": { "value": 1, "message": "Minimum value is 1" },
          "max": { "value": 150, "message": "Maximum value is 150" }
        }
      }
    ],
    "label": "Set send/receive size limits",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2023-11-16",
    "powershellEquivalent": "Set-MailboxPlan",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.calDefault",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Sets the default sharing level for the default calendar, for all users",
    "docsDescription": "Sets the default sharing level for the default calendar for all users in the tenant. You can read about the different sharing levels [here.](https://learn.microsoft.com/en-us/powershell/module/exchange/set-mailboxfolderpermission?view=exchange-ps#-accessrights)",
    "executiveText": "Configures how much calendar information employees share by default with colleagues, balancing collaboration needs with privacy. This setting determines whether others can see meeting details, free/busy times, or just availability, helping optimize scheduling while protecting sensitive meeting information.",
    "disabledFeatures": { "report": true, "warn": true, "remediate": false },
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "label": "Select Sharing Level",
        "name": "standards.calDefault.permissionLevel",
        "options": [
          {
            "label": "Owner - The user can create, read, edit, and delete all items in the folder, and create subfolders. The user is both folder owner and folder contact.",
            "value": "Owner"
          },
          {
            "label": "Publishing Editor - The user can create, read, edit, and delete all items in the folder, and create subfolders.",
            "value": "PublishingEditor"
          },
          {
            "label": "Editor - The user can create items in the folder. The contents of the folder do not appear.",
            "value": "Editor"
          },
          {
            "label": "Publishing Author.  The user can read, create all items/subfolders. Can modify and delete only items they create.",
            "value": "PublishingAuthor"
          },
          {
            "label": "Author - The user can create and read items, and modify and delete items that they create.",
            "value": "Author"
          },
          {
            "label": "Non Editing Author - The user has full read access and create items. Can can delete only own items.",
            "value": "NonEditingAuthor"
          },
          { "label": "Reviewer - The user can read all items in the folder.", "value": "Reviewer" },
          {
            "label": "Contributor - The user can create items and folders.",
            "value": "Contributor"
          },
          {
            "label": "Availability Only - Indicates that the user can view only free/busy time within the calendar.",
            "value": "AvailabilityOnly"
          },
          {
            "label": "Limited Details - The user can view free/busy time within the calendar and the subject and location of appointments.",
            "value": "LimitedDetails"
          },
          { "label": "None - The user has no permissions on the folder.", "value": "none" }
        ]
      }
    ],
    "label": "Set Sharing Level for Default calendar",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2023-04-27",
    "powershellEquivalent": "Set-MailboxFolderPermission",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.EXOOutboundSpamLimits",
    "cat": "Exchange Standards",
    "tag": ["CIS M365 7.0.0 (2.1.15)"],
    "appliesToTest": ["CIS_2_1_15"],
    "helpText": "Configures the outbound spam recipient limits (external per hour, internal per hour, per day) and the action to take when a limit is reached. The 'Set Outbound Spam Alert e-mail' standard is recommended to configure together with this one. ",
    "docsDescription": "Configures the Exchange Online outbound spam recipient limits for external per hour, internal per hour, and per day, along with the action to take (e.g., BlockUser, Alert) when these limits are exceeded. This helps prevent abuse and manage email flow. Microsoft's recommendations can be found [here.](https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365#eop-outbound-spam-policy-settings) The 'Set Outbound Spam Alert e-mail' standard is recommended to configure together with this one.",
    "executiveText": "Sets limits on how many emails employees can send per hour and per day to prevent spam and protect the organization's email reputation. When limits are exceeded, the system can alert administrators or temporarily block the user, helping detect compromised accounts or prevent abuse.",
    "addedComponent": [
      {
        "type": "number",
        "name": "standards.EXOOutboundSpamLimits.RecipientLimitExternalPerHour",
        "label": "External Recipient Limit Per Hour",
        "defaultValue": 400,
        "validators": {
          "min": { "value": 0, "message": "Minimum value is 0" },
          "max": { "value": 10000, "message": "Maximum value is 10000" }
        }
      },
      {
        "type": "number",
        "name": "standards.EXOOutboundSpamLimits.RecipientLimitInternalPerHour",
        "label": "Internal Recipient Limit Per Hour",
        "defaultValue": 800,
        "validators": {
          "min": { "value": 0, "message": "Minimum value is 0" },
          "max": { "value": 10000, "message": "Maximum value is 10000" }
        }
      },
      {
        "type": "number",
        "name": "standards.EXOOutboundSpamLimits.RecipientLimitPerDay",
        "label": "Daily Recipient Limit",
        "defaultValue": 800,
        "validators": {
          "min": { "value": 0, "message": "Minimum value is 0" },
          "max": { "value": 10000, "message": "Maximum value is 10000" }
        }
      },
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "name": "standards.EXOOutboundSpamLimits.ActionWhenThresholdReached",
        "label": "Action When Threshold Reached",
        "options": [
          { "label": "Alert", "value": "Alert" },
          { "label": "Block User", "value": "BlockUser" },
          {
            "label": "Block user from sending mail for the rest of the day",
            "value": "BlockUserForToday"
          }
        ]
      }
    ],
    "label": "Set Exchange Outbound Spam Limits",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-05-13",
    "powershellEquivalent": "Set-HostedOutboundSpamFilterPolicy",
    "recommendedBy": ["CIPP", "CIS"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.DisableExternalCalendarSharing",
    "cat": "Exchange Standards",
    "tag": ["CIS M365 7.0.0 (1.3.3)", "exo_individualsharing"],
    "appliesToTest": ["CISAMSEXO62", "CIS_1_3_3", "ZTNA21803"],
    "helpText": "Disables the ability for users to share their calendar with external users. Only for the default policy, so exclusions can be made if needed.",
    "docsDescription": "Disables external calendar sharing for the entire tenant. This is not a widely used feature, and it's therefore unlikely that this will impact users. Only for the default policy, so exclusions can be made if needed by making a new policy and assigning it to users.",
    "executiveText": "Prevents employees from sharing their calendars with external parties, protecting sensitive meeting information and internal schedules from unauthorized access. This security measure helps maintain confidentiality of business activities while still allowing internal collaboration.",
    "addedComponent": [],
    "label": "Disable external calendar sharing",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-01-08",
    "powershellEquivalent": "Get-SharingPolicy | Set-SharingPolicy -Enabled $False",
    "recommendedBy": ["CIS"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.AutoAddProxy",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Automatically adds all available domains as a proxy address.",
    "docsDescription": "Automatically finds all available domain names in the tenant, and tries to add proxy addresses based on the user's UPN to each of these.",
    "executiveText": "Automatically creates email addresses for employees across all company domains, ensuring they can receive emails sent to any of the organization's domain names. This improves email delivery reliability and maintains consistent communication channels across different business units or brands.",
    "addedComponent": [],
    "label": "Automatically deploy proxy addresses",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2025-02-07",
    "powershellEquivalent": "Set-Mailbox -EmailAddresses @{add=$EmailAddress}",
    "recommendedBy": [],
    "disabledFeatures": { "report": false, "warn": true, "remediate": false }
  },
  {
    "name": "standards.DisableAdditionalStorageProviders",
    "cat": "Exchange Standards",
    "tag": ["CIS M365 7.0.0 (6.5.3)", "exo_storageproviderrestricted"],
    "appliesToTest": ["CIS_6_5_3", "ZTNA21817"],
    "helpText": "Disables the ability for users to open files in Outlook on the Web, from other providers such as Box, Dropbox, Facebook, Google Drive, OneDrive Personal, etc.",
    "docsDescription": "Disables additional storage providers in OWA. This is to prevent users from using personal storage providers like Dropbox, Google Drive, etc. Usually this has little user impact.",
    "executiveText": "Prevents employees from accessing personal cloud storage services like Dropbox or Google Drive through Outlook on the web, reducing data security risks and ensuring company information stays within approved corporate systems. This helps maintain data governance and prevents accidental data leaks.",
    "addedComponent": [],
    "label": "Disable additional storage providers in OWA",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-01-17",
    "powershellEquivalent": "Get-OwaMailboxPolicy | Set-OwaMailboxPolicy -AdditionalStorageProvidersEnabled $False",
    "recommendedBy": ["CIS"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.AntiSpamSafeList",
    "cat": "Defender Standards",
    "tag": ["CIS M365 7.0.0 (2.1.13)"],
    "appliesToTest": ["CIS_2_1_13"],
    "helpText": "Sets the anti-spam connection filter policy option 'safe list' in Defender.",
    "docsDescription": "Sets [Microsoft's built-in 'safe list'](https://learn.microsoft.com/en-us/powershell/module/exchange/set-hostedconnectionfilterpolicy?view=exchange-ps#-enablesafelist) in the anti-spam connection filter policy, rather than setting a custom safe/block list of IPs.",
    "executiveText": "Enables Microsoft's pre-approved list of trusted email servers to improve email delivery from legitimate sources while maintaining spam protection. This reduces false positives where legitimate emails might be blocked while still protecting against spam and malicious emails.",
    "addedComponent": [
      {
        "type": "switch",
        "name": "standards.AntiSpamSafeList.EnableSafeList",
        "label": "Enable Safe List"
      }
    ],
    "label": "Set Anti-Spam Connection Filter Safe List",
    "impact": "Medium Impact",
    "impactColour": "info",
    "addedDate": "2025-02-15",
    "powershellEquivalent": "Set-HostedConnectionFilterPolicy \"Default\" -EnableSafeList $true",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.ShortenMeetings",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Sets the shorten meetings settings on a tenant level. This will shorten meetings by the selected amount of minutes. Valid values are 0 to 29. Short meetings are under 60 minutes, long meetings are over 60 minutes.",
    "executiveText": "Automatically shortens calendar meetings by a specified number of minutes to provide buffer time between meetings, reducing back-to-back scheduling stress and allowing employees time to transition between meetings. This improves work-life balance and meeting effectiveness.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "label": "Select value",
        "name": "standards.ShortenMeetings.ShortenEventScopeDefault",
        "options": [
          { "label": "Disabled/None", "value": "None" },
          { "label": "End early", "value": "EndEarly" },
          { "label": "Start late", "value": "StartLate" }
        ]
      },
      {
        "type": "number",
        "name": "standards.ShortenMeetings.DefaultMinutesToReduceShortEventsBy",
        "label": "Minutes to reduce short calendar events by (Default is 5)",
        "defaultValue": 5,
        "validators": {
          "min": { "value": 0, "message": "Minimum value is 0" },
          "max": { "value": 29, "message": "Maximum value is 29" }
        }
      },
      {
        "type": "number",
        "name": "standards.ShortenMeetings.DefaultMinutesToReduceLongEventsBy",
        "label": "Minutes to reduce long calendar events by (Default is 10)",
        "defaultValue": 10,
        "validators": {
          "min": { "value": 0, "message": "Minimum value is 0" },
          "max": { "value": 29, "message": "Maximum value is 29" }
        }
      }
    ],
    "label": "Set shorten meetings state",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2024-05-27",
    "powershellEquivalent": "Set-OrganizationConfig -ShortenEventScopeDefault -DefaultMinutesToReduceShortEventsBy -DefaultMinutesToReduceLongEventsBy",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.Bookings",
    "cat": "Exchange Standards",
    "tag": ["CIS M365 7.0.0 (1.3.9)"],
    "appliesToTest": ["CIS_1_3_9"],
    "helpText": "Sets the state of Bookings on the tenant. Bookings is a scheduling tool that allows users to book appointments with others both internal and external.",
    "docsDescription": "",
    "executiveText": "Controls whether employees can use Microsoft Bookings to create online appointment scheduling pages for internal and external clients. This feature can improve customer service and streamline appointment management, but may need to be controlled for security or business process reasons.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "label": "Select value",
        "name": "standards.Bookings.state",
        "options": [
          { "label": "Enabled", "value": "true" },
          { "label": "Disabled", "value": "false" }
        ]
      }
    ],
    "label": "Set Bookings state",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2024-05-31",
    "powershellEquivalent": "Set-OrganizationConfig -BookingsEnabled",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.EXODirectSend",
    "cat": "Exchange Standards",
    "tag": ["CIS M365 7.0.0 (6.5.5)"],
    "appliesToTest": ["CIS_6_5_5"],
    "helpText": "Sets the state of Direct Send in Exchange Online. Direct Send allows applications to send emails directly to Exchange Online mailboxes as the tenants domains, without requiring authentication.",
    "docsDescription": "Controls whether applications can use Direct Send to send emails directly to Exchange Online mailboxes as the tenants domains, without requiring authentication. A detailed explanation from Microsoft can be found [here.](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365)",
    "executiveText": "Controls whether business applications and devices (like printers or scanners) can send emails through the company's email system without authentication. While this enables convenient features like scan-to-email, it may pose security risks and should be carefully managed.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "Select value",
        "name": "standards.EXODirectSend.state",
        "options": [
          { "label": "Enabled", "value": "enabled" },
          { "label": "Disabled", "value": "disabled" }
        ]
      }
    ],
    "label": "Set Direct Send state",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2025-05-28",
    "powershellEquivalent": "Set-OrganizationConfig -RejectDirectSend $true/$false",
    "recommendedBy": []
  },
  {
    "name": "standards.DisableOutlookAddins",
    "cat": "Exchange Standards",
    "tag": [
      "CIS M365 7.0.0 (6.3.1)",
      "exo_outlookaddins",
      "NIST CSF 2.0 (PR.AA-05)",
      "NIST CSF 2.0 (PR.PS-05)"
    ],
    "appliesToTest": ["CIS_6_3_1", "ZTNA21817"],
    "helpText": "Disables the ability for users to install add-ins in Outlook. This is to prevent users from installing malicious add-ins.",
    "docsDescription": "Disables users from being able to install add-ins in Outlook. Only admins are able to approve add-ins for the users. This is done to reduce the threat surface for data exfiltration.",
    "executiveText": "Prevents employees from installing third-party add-ins in Outlook without administrative approval, reducing security risks from potentially malicious extensions. This ensures only vetted and approved tools can access company email data while maintaining centralized control over email functionality.",
    "addedComponent": [],
    "label": "Disable users from installing add-ins in Outlook",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2024-02-05",
    "powershellEquivalent": "Get-ManagementRoleAssignment | Remove-ManagementRoleAssignment",
    "recommendedBy": ["CIS"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.SafeSendersDisable",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Loops through all users and removes the Safe Senders list. This is to prevent SPF bypass attacks, as the Safe Senders list is not checked by SPF.",
    "executiveText": "Removes user-defined safe sender lists to prevent security bypasses where malicious emails could avoid spam filtering. This ensures all emails go through proper security screening, even if users have previously marked senders as 'safe', improving overall email security.",
    "addedComponent": [],
    "disabledFeatures": { "report": true, "warn": true, "remediate": false },
    "label": "Remove Safe Senders to prevent SPF bypass",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2023-10-26",
    "powershellEquivalent": "Set-MailboxJunkEmailConfiguration",
    "recommendedBy": ["CIPP"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.DelegateSentItems",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Sets emails sent as and on behalf of shared mailboxes to also be stored in the shared mailbox sent items folder",
    "docsDescription": "This makes sure that e-mails sent from shared mailboxes or delegate mailboxes, end up in the mailbox of the shared/delegate mailbox instead of the sender, allowing you to keep replies in the same mailbox as the original e-mail.",
    "executiveText": "Ensures emails sent from shared mailboxes (like info@company.com) are stored in the shared mailbox rather than the individual sender's mailbox. This maintains complete email threads in one location, improving collaboration and ensuring all team members can see the full conversation history.",
    "addedComponent": [
      {
        "type": "switch",
        "label": "Include user mailboxes",
        "name": "standards.DelegateSentItems.IncludeUserMailboxes"
      }
    ],
    "label": "Set mailbox Sent Items delegation (Sent items for shared mailboxes)",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2021-11-16",
    "powershellEquivalent": "Set-Mailbox",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.SendFromAlias",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Enables or disables the ability for users to send from their alias addresses.",
    "docsDescription": "Allows users to change the 'from' address to any set in their Azure AD Profile.",
    "executiveText": "Allows employees to send emails from their alternative email addresses (aliases) rather than just their primary address. This is useful for employees who manage multiple roles or departments, enabling them to send emails from the most appropriate address for the context.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "Select value",
        "name": "standards.SendFromAlias.state",
        "options": [
          { "label": "Enabled", "value": "true" },
          { "label": "Disabled", "value": "false" }
        ]
      }
    ],
    "label": "Set Send from alias state",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2022-05-25",
    "powershellEquivalent": "Set-Mailbox",
    "recommendedBy": ["CIPP"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.DlpViaDcsEnabled",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Sets whether Outlook on the web uses Data Classification Services for DLP evaluation. See [Microsoft's policy tip reference](https://learn.microsoft.com/en-us/purview/dlp-ol365-win32-policy-tips#sensitive-information-types-that-support-policy-tips-for-outlook-perpetual-users).",
    "docsDescription": "Configures whether Outlook on the web uses Data Classification Services (DCS)-based Data Loss Prevention (DLP) policy evaluation instead of Exchange-based evaluation. Review DLP policies before enabling this setting, as some legacy Exchange-based predicates are not supported with DCS-based evaluation. See [Microsoft's policy tip reference](https://learn.microsoft.com/en-us/purview/dlp-ol365-win32-policy-tips#sensitive-information-types-that-support-policy-tips-for-outlook-perpetual-users).",
    "executiveText": "Improves how Outlook on the web applies Data Loss Prevention policies, giving users clearer guidance when sensitive information may be shared and helping reduce accidental data exposure.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "Select value",
        "name": "standards.DlpViaDcsEnabled.state",
        "options": [
          { "label": "Enabled", "value": "true" },
          { "label": "Disabled", "value": "false" }
        ]
      }
    ],
    "label": "Set OWA DLP evaluation via DCS",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2026-05-20",
    "powershellEquivalent": "Set-OrganizationConfig -DlpViaDcsEnabled",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.UserSubmissions",
    "cat": "Exchange Standards",
    "tag": ["CIS M365 7.0.0 (8.6.1)"],
    "appliesToTest": ["CIS_8_6_1"],
    "helpText": "Set the state of the spam submission button in Outlook",
    "docsDescription": "Set the state of the built-in Report button in Outlook. This gives the users the ability to report emails as spam or phish.",
    "executiveText": "Enables employees to easily report suspicious emails directly from Outlook, helping improve the organization's spam and phishing detection systems. This crowdsourced approach to security allows users to contribute to threat detection while providing valuable feedback to enhance email security filters.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "label": "Select value",
        "name": "standards.UserSubmissions.state",
        "options": [
          { "label": "Enabled", "value": "enable" },
          { "label": "Disabled", "value": "disable" }
        ]
      },
      {
        "type": "textField",
        "name": "standards.UserSubmissions.email",
        "required": false,
        "label": "Destination email address"
      }
    ],
    "label": "Set the state of the built-in Report button in Outlook",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2024-06-28",
    "powershellEquivalent": "New-ReportSubmissionPolicy or Set-ReportSubmissionPolicy and New-ReportSubmissionRule or Set-ReportSubmissionRule",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.DisableSharedMailbox",
    "cat": "Exchange Standards",
    "tag": [
      "CIS M365 7.0.0 (1.2.2)",
      "CISA (MS.AAD.10.1v1)",
      "NIST CSF 2.0 (PR.AA-01)",
      "SMB1001 (2.3)"
    ],
    "appliesToTest": ["CIS_1_2_2", "SMB1001_2_3"],
    "helpText": "Blocks login for all accounts that are marked as a shared mailbox. This is Microsoft best practice to prevent direct logons to shared mailboxes.",
    "docsDescription": "Shared mailboxes can be directly logged into if the password is reset, this presents a security risk as do all shared login credentials. Microsoft's recommendation is to disable the user account for shared mailboxes. It would be a good idea to review the sign-in reports to establish potential impact.",
    "executiveText": "Prevents direct login to shared mailbox accounts (like info@company.com), ensuring they can only be accessed through authorized users' accounts. This security measure eliminates the risk of shared passwords and unauthorized access while maintaining proper access control and audit trails.",
    "addedComponent": [],
    "label": "Disable Shared Mailbox Entra accounts",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2021-11-16",
    "powershellEquivalent": "Get-Mailbox & Update-MgUser",
    "recommendedBy": ["CIS", "CIPP"]
  },
  {
    "name": "standards.DisableResourceMailbox",
    "cat": "Exchange Standards",
    "tag": ["NIST CSF 2.0 (PR.AA-01)", "SMB1001 (2.3)"],
    "appliesToTest": ["SMB1001_2_3"],
    "helpText": "Blocks login for all accounts that are marked as a resource mailbox and does not have a license assigned. Accounts that are synced from on-premises AD are excluded, as account state is managed in the on-premises AD.",
    "docsDescription": "Resource mailboxes can be directly logged into if the password is reset, this presents a security risk as do all shared login credentials. Microsoft's recommendation is to disable the user account for resource mailboxes. Accounts that are synced from on-premises AD are excluded, as account state is managed in the on-premises AD.",
    "executiveText": "Prevents direct login to resource mailbox accounts (like conference rooms or equipment), ensuring they can only be managed through proper administrative channels. This security measure eliminates potential unauthorized access to resource scheduling systems while maintaining proper booking functionality.",
    "addedComponent": [],
    "label": "Disable Unlicensed Resource Mailbox Entra accounts",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2025-06-01",
    "powershellEquivalent": "Get-Mailbox & Update-MgUser",
    "recommendedBy": ["Microsoft", "CIPP"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.EXODisableAutoForwarding",
    "cat": "Exchange Standards",
    "tag": [
      "CIS M365 7.0.0 (6.2.1)",
      "mdo_autoforwardingmode",
      "mdo_blockmailforward",
      "CISA (MS.EXO.4.1v1)",
      "NIST CSF 2.0 (PR.DS-02)"
    ],
    "appliesToTest": ["CIS_6_2_1"],
    "helpText": "Disables the ability for users to automatically forward e-mails to external recipients.",
    "docsDescription": "Disables the ability for users to automatically forward e-mails to external recipients. This is to prevent data exfiltration. Please check if there are any legitimate use cases for this feature before implementing, like forwarding invoices and such.",
    "executiveText": "Prevents employees from automatically forwarding company emails to external addresses, protecting against data leaks and unauthorized information sharing. This security measure helps maintain control over sensitive business communications while preventing both accidental and intentional data exfiltration.",
    "addedComponent": [],
    "label": "Disable automatic forwarding to external recipients",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2024-07-26",
    "powershellEquivalent": "Set-HostedOutboundSpamFilterPolicy -AutoForwardingMode 'Off'",
    "recommendedBy": ["CIS", "CIPP"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.RetentionPolicyTag",
    "cat": "Exchange Standards",
    "tag": ["SMB1001 (3.1)"],
    "appliesToTest": ["SMB1001_3_1"],
    "helpText": "Creates a CIPP - Deleted Items retention policy tag that permanently deletes items in the Deleted Items folder after X days.",
    "docsDescription": "Creates a CIPP - Deleted Items retention policy tag that permanently deletes items in the Deleted Items folder after X days.",
    "executiveText": "Automatically and permanently removes deleted emails after a specified number of days, helping manage storage costs and ensuring compliance with data retention policies. This prevents accumulation of unnecessary deleted items while maintaining a reasonable recovery window for accidentally deleted emails.",
    "addedComponent": [
      {
        "type": "number",
        "name": "standards.RetentionPolicyTag.AgeLimitForRetention",
        "label": "Retention Days",
        "required": true
      }
    ],
    "label": "Retention Policy, permanently delete items in Deleted Items after X days",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2025-02-02",
    "powershellEquivalent": "Set-RetentionPolicyTag",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.QuarantineRequestAlert",
    "cat": "Defender Standards",
    "tag": [],
    "helpText": "Sets a e-mail address to alert when a User requests to release a quarantined message.",
    "docsDescription": "Sets a e-mail address to alert when a User requests to release a quarantined message. This is useful for monitoring and ensuring that the correct messages are released.",
    "executiveText": "Notifies IT administrators when employees request to release emails that were quarantined for security reasons, enabling oversight of potentially dangerous messages. This helps ensure that legitimate emails are released while maintaining security controls over suspicious content.",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.QuarantineRequestAlert.NotifyUser",
        "label": "E-mail to receive the alert"
      }
    ],
    "label": "Quarantine Release Request Alert",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-07-15",
    "powershellEquivalent": "New-ProtectionAlert and Set-ProtectionAlert",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.SharePointMassDeletionAlert",
    "cat": "Defender Standards",
    "tag": [],
    "helpText": "Sets a e-mail address to alert when a User deletes more than 20 SharePoint files within 60 minutes. NB: Requires a Office 365 E5 subscription, Office 365 E3 with Threat Intelligence or Office 365 EquivioAnalytics add-on.",
    "docsDescription": "Sets a e-mail address to alert when a User deletes more than 20 SharePoint files within 60 minutes. This is useful for monitoring and ensuring that the correct SharePoint files are deleted. NB: Requires a Office 365 E5 subscription, Office 365 E3 with Threat Intelligence or Office 365 EquivioAnalytics add-on.",
    "executiveText": "Alerts administrators when employees delete large numbers of SharePoint files in a short time period, helping detect potential data destruction attacks, ransomware, or accidental mass deletions. This early warning system enables rapid response to protect critical business documents and data.",
    "addedComponent": [
      {
        "type": "number",
        "name": "standards.SharePointMassDeletionAlert.Threshold",
        "label": "Max files to delete within the time frame",
        "defaultValue": 20
      },
      {
        "type": "number",
        "name": "standards.SharePointMassDeletionAlert.TimeWindow",
        "label": "Time frame in minutes",
        "defaultValue": 60
      },
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": true,
        "required": true,
        "name": "standards.SharePointMassDeletionAlert.NotifyUser",
        "label": "E-mail to receive the alert"
      }
    ],
    "label": "SharePoint Mass Deletion Alert",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-04-07",
    "powershellEquivalent": "New-ProtectionAlert and Set-ProtectionAlert",
    "recommendedBy": [],
    "requiredCapabilities": ["RMS_S_PREMIUM2"]
  },
  {
    "name": "standards.SafeLinksTemplatePolicy",
    "label": "SafeLinks Policy Template",
    "cat": "Templates",
    "multiple": false,
    "disabledFeatures": { "report": false, "warn": false, "remediate": false },
    "impact": "Medium Impact",
    "addedDate": "2025-04-29",
    "helpText": "Deploy and manage SafeLinks policy templates to protect against malicious URLs in emails and Office documents.",
    "executiveText": "Deploys standardized URL protection policies that automatically scan and verify links in emails and documents before users click them. This template-based approach ensures consistent protection against malicious websites and phishing attacks across the organization.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": false,
        "name": "standards.SafeLinksTemplatePolicy.TemplateIds",
        "label": "Select SafeLinks Policy Templates",
        "api": {
          "url": "/api/ListSafeLinksPolicyTemplates",
          "labelField": "TemplateName",
          "valueField": "GUID",
          "queryKey": "ListSafeLinksPolicyTemplates"
        }
      }
    ],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.SafeLinksPolicy",
    "cat": "Defender Standards",
    "tag": [
      "CIS M365 7.0.0 (2.1.1)",
      "mdo_safelinksforemail",
      "mdo_safelinksforOfficeApps",
      "NIST CSF 2.0 (DE.CM-09)"
    ],
    "appliesToTest": [
      "CISAMSEXO151",
      "CISAMSEXO152",
      "CISAMSEXO153",
      "CIS_2_1_1",
      "ORCA105",
      "ORCA106",
      "ORCA107",
      "ORCA112",
      "ORCA113",
      "ORCA114",
      "ORCA116",
      "ORCA119",
      "ORCA156",
      "ORCA179",
      "ORCA189_2",
      "ORCA226",
      "ORCA236",
      "ORCA237",
      "ORCA238"
    ],
    "helpText": "This creates a Safe Links policy that automatically scans, tracks, and and enables safe links for Email, Office, and Teams for both external and internal senders",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.SafeLinksPolicy.name",
        "label": "Policy Name",
        "required": true,
        "defaultValue": "CIPP Default SafeLinks Policy"
      },
      {
        "type": "switch",
        "label": "AllowClickThrough",
        "name": "standards.SafeLinksPolicy.AllowClickThrough"
      },
      {
        "type": "switch",
        "label": "DisableUrlRewrite",
        "name": "standards.SafeLinksPolicy.DisableUrlRewrite"
      },
      {
        "type": "switch",
        "label": "EnableOrganizationBranding",
        "name": "standards.SafeLinksPolicy.EnableOrganizationBranding"
      },
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": true,
        "required": false,
        "name": "standards.SafeLinksPolicy.DoNotRewriteUrls",
        "label": "Do not rewrite the following URLs in email"
      }
    ],
    "label": "Default Safe Links Policy",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-03-25",
    "powershellEquivalent": "Set-SafeLinksPolicy or New-SafeLinksPolicy",
    "recommendedBy": ["CIS"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.AntiPhishPolicy",
    "cat": "Defender Standards",
    "tag": [
      "mdo_safeattachments",
      "mdo_highconfidencespamaction",
      "mdo_highconfidencephishaction",
      "mdo_phisspamacation",
      "mdo_spam_notifications_only_for_admins",
      "mdo_antiphishingpolicies",
      "mdo_phishthresholdlevel",
      "CIS M365 7.0.0 (2.1.7)",
      "NIST CSF 2.0 (DE.CM-09)"
    ],
    "appliesToTest": [
      "CISAMSEXO111",
      "CISAMSEXO112",
      "CISAMSEXO113",
      "CIS_2_1_7",
      "ORCA104",
      "ORCA115",
      "ORCA180",
      "ORCA220",
      "ORCA221",
      "ORCA222",
      "ORCA223",
      "ORCA228",
      "ORCA229",
      "ORCA230",
      "ORCA233",
      "ORCA234",
      "ORCA235",
      "ORCA239",
      "ORCA242",
      "ORCA243",
      "ORCA244",
      "ZTNA21784",
      "ZTNA21817",
      "ZTNA21819"
    ],
    "helpText": "This creates a Anti-Phishing policy that automatically enables Mailbox Intelligence and spoofing, optional switches for Mail tips.",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.AntiPhishPolicy.name",
        "label": "Policy Name",
        "required": true,
        "defaultValue": "CIPP Default Anti-Phishing Policy"
      },
      {
        "type": "number",
        "label": "Phishing email threshold. (Default 1)",
        "name": "standards.AntiPhishPolicy.PhishThresholdLevel",
        "defaultValue": 1,
        "validators": {
          "min": { "value": 1, "message": "Minimum value is 1" },
          "max": { "value": 4, "message": "Maximum value is 4" }
        }
      },
      {
        "type": "switch",
        "label": "Show first contact safety tip",
        "name": "standards.AntiPhishPolicy.EnableFirstContactSafetyTips",
        "defaultValue": true
      },
      {
        "type": "switch",
        "label": "Show user impersonation safety tip",
        "name": "standards.AntiPhishPolicy.EnableSimilarUsersSafetyTips",
        "defaultValue": true
      },
      {
        "type": "switch",
        "label": "Show domain impersonation safety tip",
        "name": "standards.AntiPhishPolicy.EnableSimilarDomainsSafetyTips",
        "defaultValue": true
      },
      {
        "type": "switch",
        "label": "Show user impersonation unusual characters safety tip",
        "name": "standards.AntiPhishPolicy.EnableUnusualCharactersSafetyTips",
        "defaultValue": true
      },
      {
        "type": "select",
        "multiple": false,
        "label": "If the message is detected as spoof by spoof intelligence",
        "name": "standards.AntiPhishPolicy.AuthenticationFailAction",
        "options": [
          { "label": "Quarantine the message", "value": "Quarantine" },
          { "label": "Move to Junk Folder", "value": "MoveToJmf" }
        ]
      },
      {
        "type": "select",
        "multiple": false,
        "creatable": true,
        "label": "Quarantine policy for Spoof",
        "name": "standards.AntiPhishPolicy.SpoofQuarantineTag",
        "options": [
          { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" },
          { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" },
          {
            "label": "DefaultFullAccessWithNotificationPolicy",
            "value": "DefaultFullAccessWithNotificationPolicy"
          }
        ]
      },
      {
        "type": "select",
        "multiple": false,
        "label": "If a message is detected as user impersonation",
        "name": "standards.AntiPhishPolicy.TargetedUserProtectionAction",
        "options": [
          { "label": "Move to Junk Folder", "value": "MoveToJmf" },
          { "label": "Delete the message before its delivered", "value": "Delete" },
          { "label": "Quarantine the message", "value": "Quarantine" }
        ]
      },
      {
        "type": "select",
        "multiple": false,
        "creatable": true,
        "label": "Quarantine policy for user impersonation",
        "name": "standards.AntiPhishPolicy.TargetedUserQuarantineTag",
        "options": [
          { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" },
          { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" },
          {
            "label": "DefaultFullAccessWithNotificationPolicy",
            "value": "DefaultFullAccessWithNotificationPolicy"
          }
        ]
      },
      {
        "type": "select",
        "multiple": false,
        "label": "If a message is detected as domain impersonation",
        "name": "standards.AntiPhishPolicy.TargetedDomainProtectionAction",
        "options": [
          { "label": "Move to Junk Folder", "value": "MoveToJmf" },
          { "label": "Delete the message before its delivered", "value": "Delete" },
          { "label": "Quarantine the message", "value": "Quarantine" }
        ]
      },
      {
        "type": "select",
        "multiple": false,
        "creatable": true,
        "label": "Quarantine policy for domain impersonation",
        "name": "standards.AntiPhishPolicy.TargetedDomainQuarantineTag",
        "options": [
          {
            "label": "DefaultFullAccessWithNotificationPolicy",
            "value": "DefaultFullAccessWithNotificationPolicy"
          },
          { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" },
          { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" }
        ]
      },
      {
        "type": "select",
        "multiple": false,
        "label": "If Mailbox Intelligence detects an impersonated user",
        "name": "standards.AntiPhishPolicy.MailboxIntelligenceProtectionAction",
        "options": [
          { "label": "Move to Junk Folder", "value": "MoveToJmf" },
          { "label": "Delete the message before its delivered", "value": "Delete" },
          { "label": "Quarantine the message", "value": "Quarantine" }
        ]
      },
      {
        "type": "select",
        "multiple": false,
        "creatable": true,
        "label": "Apply quarantine policy",
        "name": "standards.AntiPhishPolicy.MailboxIntelligenceQuarantineTag",
        "options": [
          { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" },
          { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" },
          {
            "label": "DefaultFullAccessWithNotificationPolicy",
            "value": "DefaultFullAccessWithNotificationPolicy"
          }
        ]
      }
    ],
    "label": "Default Anti-Phishing Policy",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-03-25",
    "powershellEquivalent": "Set-AntiPhishPolicy or New-AntiPhishPolicy",
    "recommendedBy": ["CIS"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.SafeAttachmentPolicy",
    "cat": "Defender Standards",
    "tag": [
      "CIS M365 7.0.0 (2.1.4)",
      "mdo_safedocuments",
      "mdo_commonattachmentsfilter",
      "mdo_safeattachmentpolicy",
      "NIST CSF 2.0 (DE.CM-09)"
    ],
    "appliesToTest": ["CIS_2_1_4", "ORCA158", "ORCA189", "ORCA227"],
    "helpText": "This creates a Safe Attachment policy",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.SafeAttachmentPolicy.name",
        "label": "Policy Name",
        "required": true,
        "defaultValue": "CIPP Default Safe Attachment Policy"
      },
      {
        "type": "select",
        "multiple": false,
        "label": "Safe Attachment Action",
        "name": "standards.SafeAttachmentPolicy.SafeAttachmentAction",
        "options": [
          { "label": "Allow", "value": "Allow" },
          { "label": "Block", "value": "Block" },
          { "label": "DynamicDelivery", "value": "DynamicDelivery" }
        ]
      },
      {
        "type": "select",
        "multiple": false,
        "creatable": true,
        "label": "QuarantineTag",
        "name": "standards.SafeAttachmentPolicy.QuarantineTag",
        "options": [
          { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" },
          { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" },
          {
            "label": "DefaultFullAccessWithNotificationPolicy",
            "value": "DefaultFullAccessWithNotificationPolicy"
          }
        ]
      },
      { "type": "switch", "label": "Redirect", "name": "standards.SafeAttachmentPolicy.Redirect" },
      {
        "type": "textField",
        "name": "standards.SafeAttachmentPolicy.RedirectAddress",
        "label": "Redirect Address",
        "required": false,
        "condition": {
          "field": "standards.SafeAttachmentPolicy.Redirect",
          "compareType": "is",
          "compareValue": true
        }
      }
    ],
    "label": "Default Safe Attachment Policy",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-03-25",
    "powershellEquivalent": "Set-SafeAttachmentPolicy or New-SafeAttachmentPolicy",
    "recommendedBy": ["CIS"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.AtpPolicyForO365",
    "cat": "Defender Standards",
    "tag": ["CIS M365 7.0.0 (2.1.5)", "NIST CSF 2.0 (DE.CM-09)"],
    "appliesToTest": ["CIS_2_1_5", "ORCA225"],
    "helpText": "This creates a Atp policy that enables Defender for Office 365 for SharePoint, OneDrive and Microsoft Teams.",
    "addedComponent": [
      {
        "type": "switch",
        "label": "Allow people to click through Protected View even if Safe Documents identified the file as malicious",
        "name": "standards.AtpPolicyForO365.AllowSafeDocsOpen",
        "defaultValue": false,
        "required": false
      }
    ],
    "label": "Default Atp Policy For O365",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-03-25",
    "powershellEquivalent": "Set-AtpPolicyForO365",
    "recommendedBy": ["CIS"],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.PhishingSimulations",
    "cat": "Defender Standards",
    "tag": ["SMB1001 (1.11)", "SMB1001 (5.1)"],
    "appliesToTest": ["SMB1001_1_11", "SMB1001_5_1"],
    "helpText": "This creates a phishing simulation policy that enables phishing simulations for the entire tenant.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": true,
        "required": true,
        "label": "Phishing Simulation Domains",
        "name": "standards.PhishingSimulations.Domains"
      },
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": true,
        "required": true,
        "label": "Phishing Simulation Sender IP Ranges",
        "name": "standards.PhishingSimulations.SenderIpRanges"
      },
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": true,
        "required": false,
        "label": "Phishing Simulation Urls",
        "name": "standards.PhishingSimulations.PhishingSimUrls"
      },
      {
        "type": "switch",
        "label": "Remove extra urls",
        "name": "standards.PhishingSimulations.RemoveExtraUrls",
        "defaultValue": false,
        "required": false
      }
    ],
    "label": "Phishing Simulation Configuration",
    "impact": "Medium Impact",
    "impactColour": "info",
    "addedDate": "2025-03-27",
    "powershellEquivalent": "New-TenantAllowBlockListItems, New-PhishSimOverridePolicy and New-ExoPhishSimOverrideRule",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.MalwareFilterPolicy",
    "cat": "Defender Standards",
    "tag": [
      "CIS M365 7.0.0 (2.1.2)",
      "CIS M365 7.0.0 (2.1.3)",
      "CIS M365 7.0.0 (2.1.11)",
      "mdo_zapspam",
      "mdo_zapphish",
      "mdo_zapmalware",
      "NIST CSF 2.0 (DE.CM-09)"
    ],
    "appliesToTest": [
      "CISAMSEXO101",
      "CISAMSEXO102",
      "CISAMSEXO103",
      "CISAMSEXO95",
      "CIS_2_1_11",
      "CIS_2_1_2",
      "CIS_2_1_3",
      "ORCA120_malware",
      "ORCA121",
      "ORCA124",
      "ORCA205",
      "ORCA232",
      "ZTNA21817",
      "ZTNA21819"
    ],
    "helpText": "This creates a Malware filter policy that enables the default File filter and Zero-hour auto purge for malware.",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.MalwareFilterPolicy.name",
        "label": "Policy Name",
        "required": true,
        "defaultValue": "CIPP Default Malware Policy"
      },
      {
        "type": "select",
        "multiple": false,
        "label": "FileTypeAction",
        "name": "standards.MalwareFilterPolicy.FileTypeAction",
        "options": [
          { "label": "Reject", "value": "Reject" },
          { "label": "Quarantine the message", "value": "Quarantine" }
        ]
      },
      {
        "type": "textField",
        "name": "standards.MalwareFilterPolicy.OptionalFileTypes",
        "required": false,
        "label": "Optional File Types, Comma separated"
      },
      {
        "type": "select",
        "multiple": false,
        "creatable": true,
        "label": "QuarantineTag",
        "name": "standards.MalwareFilterPolicy.QuarantineTag",
        "options": [
          { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" },
          { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" },
          {
            "label": "DefaultFullAccessWithNotificationPolicy",
            "value": "DefaultFullAccessWithNotificationPolicy"
          }
        ]
      },
      {
        "type": "switch",
        "label": "Enable Internal Sender Admin Notifications",
        "required": false,
        "name": "standards.MalwareFilterPolicy.EnableInternalSenderAdminNotifications"
      },
      {
        "type": "textField",
        "name": "standards.MalwareFilterPolicy.InternalSenderAdminAddress",
        "required": false,
        "label": "Internal Sender Admin Address",
        "condition": {
          "field": "standards.MalwareFilterPolicy.EnableInternalSenderAdminNotifications",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "switch",
        "label": "Enable External Sender Admin Notifications",
        "required": false,
        "name": "standards.MalwareFilterPolicy.EnableExternalSenderAdminNotifications"
      },
      {
        "type": "textField",
        "name": "standards.MalwareFilterPolicy.ExternalSenderAdminAddress",
        "required": false,
        "label": "External Sender Admin Address",
        "condition": {
          "field": "standards.MalwareFilterPolicy.EnableExternalSenderAdminNotifications",
          "compareType": "is",
          "compareValue": true
        }
      }
    ],
    "label": "Default Malware Filter Policy",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-03-25",
    "powershellEquivalent": "Set-MalwareFilterPolicy or New-MalwareFilterPolicy",
    "recommendedBy": ["CIS"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.PhishSimSpoofIntelligence",
    "cat": "Defender Standards",
    "tag": [],
    "helpText": "This adds allowed domains to the Spoof Intelligence Allow/Block List.",
    "addedComponent": [
      {
        "type": "switch",
        "label": "Remove extra domains from the allow list",
        "name": "standards.PhishSimSpoofIntelligence.RemoveExtraDomains",
        "defaultValue": false,
        "required": false
      },
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": true,
        "required": false,
        "label": "Allowed Domains",
        "name": "standards.PhishSimSpoofIntelligence.AllowedDomains"
      }
    ],
    "label": "Add allowed domains to Spoof Intelligence",
    "impact": "Medium Impact",
    "impactColour": "info",
    "addedDate": "2025-03-28",
    "powershellEquivalent": "New-TenantAllowBlockListSpoofItems",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.SpamFilterPolicy",
    "cat": "Defender Standards",
    "tag": [],
    "appliesToTest": [
      "CISAMSEXO141",
      "CISAMSEXO142",
      "CISAMSEXO143",
      "ORCA100",
      "ORCA101",
      "ORCA102",
      "ORCA103",
      "ORCA104",
      "ORCA109",
      "ORCA110",
      "ORCA118_1",
      "ORCA118_3",
      "ORCA120_phish",
      "ORCA120_spam",
      "ORCA123",
      "ORCA139",
      "ORCA140",
      "ORCA141",
      "ORCA142",
      "ORCA143",
      "ORCA224",
      "ORCA231",
      "ORCA241"
    ],
    "helpText": "This standard creates a Spam filter policy similar to the default strict policy.",
    "docsDescription": "This standard creates a Spam filter policy similar to the default strict policy, the following settings are configured to on by default: IncreaseScoreWithNumericIps, IncreaseScoreWithRedirectToOtherPort, MarkAsSpamEmptyMessages, MarkAsSpamJavaScriptInHtml, MarkAsSpamSpfRecordHardFail, MarkAsSpamFromAddressAuthFail, MarkAsSpamNdrBackscatter, MarkAsSpamBulkMail, InlineSafetyTipsEnabled, PhishZapEnabled, SpamZapEnabled",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.SpamFilterPolicy.name",
        "label": "Policy Name",
        "required": true,
        "defaultValue": "CIPP Default Spam Filter Policy"
      },
      {
        "type": "number",
        "label": "Bulk email threshold (Default 7)",
        "name": "standards.SpamFilterPolicy.BulkThreshold",
        "defaultValue": 7,
        "validators": {
          "min": { "value": 1, "message": "Minimum value is 1" },
          "max": { "value": 9, "message": "Maximum value is 9" }
        }
      },
      {
        "type": "autoComplete",
        "required": true,
        "multiple": false,
        "creatable": false,
        "label": "Spam Action",
        "name": "standards.SpamFilterPolicy.SpamAction",
        "options": [
          { "label": "Quarantine the message", "value": "Quarantine" },
          { "label": "Move message to Junk Email folder", "value": "MoveToJmf" }
        ]
      },
      {
        "type": "autoComplete",
        "required": true,
        "multiple": false,
        "creatable": true,
        "label": "Spam Quarantine Tag",
        "name": "standards.SpamFilterPolicy.SpamQuarantineTag",
        "options": [
          { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" },
          { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" },
          {
            "label": "DefaultFullAccessWithNotificationPolicy",
            "value": "DefaultFullAccessWithNotificationPolicy"
          }
        ]
      },
      {
        "type": "autoComplete",
        "required": true,
        "multiple": false,
        "creatable": false,
        "label": "High Confidence Spam Action",
        "name": "standards.SpamFilterPolicy.HighConfidenceSpamAction",
        "options": [
          { "label": "Quarantine the message", "value": "Quarantine" },
          { "label": "Move message to Junk Email folder", "value": "MoveToJmf" }
        ]
      },
      {
        "type": "autoComplete",
        "required": true,
        "multiple": false,
        "creatable": true,
        "label": "High Confidence Spam Quarantine Tag",
        "name": "standards.SpamFilterPolicy.HighConfidenceSpamQuarantineTag",
        "options": [
          { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" },
          { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" },
          {
            "label": "DefaultFullAccessWithNotificationPolicy",
            "value": "DefaultFullAccessWithNotificationPolicy"
          }
        ]
      },
      {
        "type": "autoComplete",
        "required": true,
        "multiple": false,
        "creatable": false,
        "label": "Bulk Spam Action",
        "name": "standards.SpamFilterPolicy.BulkSpamAction",
        "options": [
          { "label": "Quarantine the message", "value": "Quarantine" },
          { "label": "Move message to Junk Email folder", "value": "MoveToJmf" }
        ]
      },
      {
        "type": "autoComplete",
        "required": true,
        "multiple": false,
        "creatable": true,
        "label": "Bulk Quarantine Tag",
        "name": "standards.SpamFilterPolicy.BulkQuarantineTag",
        "options": [
          { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" },
          { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" },
          {
            "label": "DefaultFullAccessWithNotificationPolicy",
            "value": "DefaultFullAccessWithNotificationPolicy"
          }
        ]
      },
      {
        "type": "autoComplete",
        "required": true,
        "multiple": false,
        "creatable": false,
        "label": "Phish Spam Action",
        "name": "standards.SpamFilterPolicy.PhishSpamAction",
        "options": [
          { "label": "Quarantine the message", "value": "Quarantine" },
          { "label": "Move message to Junk Email folder", "value": "MoveToJmf" }
        ]
      },
      {
        "type": "autoComplete",
        "required": true,
        "multiple": false,
        "creatable": true,
        "label": "Phish Quarantine Tag",
        "name": "standards.SpamFilterPolicy.PhishQuarantineTag",
        "options": [
          { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" },
          { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" },
          {
            "label": "DefaultFullAccessWithNotificationPolicy",
            "value": "DefaultFullAccessWithNotificationPolicy"
          }
        ]
      },
      {
        "type": "autoComplete",
        "required": true,
        "multiple": false,
        "creatable": true,
        "label": "High Confidence Phish Quarantine Tag",
        "name": "standards.SpamFilterPolicy.HighConfidencePhishQuarantineTag",
        "options": [
          { "label": "AdminOnlyAccessPolicy", "value": "AdminOnlyAccessPolicy" },
          { "label": "DefaultFullAccessPolicy", "value": "DefaultFullAccessPolicy" },
          {
            "label": "DefaultFullAccessWithNotificationPolicy",
            "value": "DefaultFullAccessWithNotificationPolicy"
          }
        ]
      },
      {
        "type": "switch",
        "name": "standards.SpamFilterPolicy.IncreaseScoreWithImageLinks",
        "label": "Increase score if message contains image links to remote websites",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.SpamFilterPolicy.IncreaseScoreWithBizOrInfoUrls",
        "label": "Increase score if message contains links to .biz or .info domains",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.SpamFilterPolicy.MarkAsSpamFramesInHtml",
        "label": "Mark as spam if message contains HTML or iframe tags",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.SpamFilterPolicy.MarkAsSpamObjectTagsInHtml",
        "label": "Mark as spam if message contains HTML object tags",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.SpamFilterPolicy.MarkAsSpamEmbedTagsInHtml",
        "label": "Mark as spam if message contains HTML embed tags",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.SpamFilterPolicy.MarkAsSpamFormTagsInHtml",
        "label": "Mark as spam if message contains HTML form tags",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.SpamFilterPolicy.MarkAsSpamWebBugsInHtml",
        "label": "Mark as spam if message contains web bugs (also known as web beacons)",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.SpamFilterPolicy.MarkAsSpamSensitiveWordList",
        "label": "Mark as spam if message contains words from the sensitive words list",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.SpamFilterPolicy.EnableLanguageBlockList",
        "label": "Enable language block list",
        "defaultValue": false
      },
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": true,
        "required": false,
        "name": "standards.SpamFilterPolicy.LanguageBlockList",
        "label": "Languages to block (uppercase ISO 639-1 two-letter)",
        "condition": {
          "field": "standards.SpamFilterPolicy.EnableLanguageBlockList",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "switch",
        "name": "standards.SpamFilterPolicy.EnableRegionBlockList",
        "label": "Enable region block list",
        "defaultValue": false
      },
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": true,
        "required": false,
        "name": "standards.SpamFilterPolicy.RegionBlockList",
        "label": "Regions to block (uppercase ISO 3166-1 two-letter)",
        "condition": {
          "field": "standards.SpamFilterPolicy.EnableRegionBlockList",
          "compareType": "is",
          "compareValue": true
        }
      },
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": true,
        "required": false,
        "name": "standards.SpamFilterPolicy.AllowedSenderDomains",
        "label": "Allowed sender domains"
      }
    ],
    "label": "Default Spam Filter Policy",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2024-07-15",
    "powershellEquivalent": "New-HostedContentFilterPolicy or Set-HostedContentFilterPolicy",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.QuarantineTemplate",
    "cat": "Defender Standards",
    "disabledFeatures": { "report": false, "warn": false, "remediate": false },
    "tag": [],
    "helpText": "This standard creates a Custom Quarantine Policies that can be used in Anti-Spam and all MDO365 policies. Quarantine Policies can be used to specify recipients permissions, enable end-user spam notifications, and specify the release action preference",
    "executiveText": "Creates standardized quarantine policies that define how employees can interact with quarantined emails, including permissions to release, delete, or preview suspicious messages. This ensures consistent security handling across the organization while providing appropriate user access to manage quarantined content.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": true,
        "name": "displayName",
        "label": "Quarantine Display Name",
        "required": true
      },
      {
        "type": "switch",
        "label": "Enable end-user spam notifications",
        "name": "ESNEnabled",
        "defaultValue": true,
        "required": false
      },
      {
        "type": "select",
        "multiple": false,
        "label": "Select release action preference",
        "name": "ReleaseAction",
        "options": [
          {
            "label": "Allow recipients to request a message to be released from quarantine",
            "value": "PermissionToRequestRelease"
          },
          {
            "label": "Allow recipients to release a message from quarantine",
            "value": "PermissionToRelease"
          }
        ]
      },
      {
        "type": "switch",
        "label": "Include Messages From Blocked Sender Address",
        "name": "IncludeMessagesFromBlockedSenderAddress",
        "defaultValue": false,
        "required": false
      },
      {
        "type": "switch",
        "label": "Allow recipients to delete message",
        "name": "PermissionToDelete",
        "defaultValue": false,
        "required": false
      },
      {
        "type": "switch",
        "label": "Allow recipients to preview message",
        "name": "PermissionToPreview",
        "defaultValue": false,
        "required": false
      },
      {
        "type": "switch",
        "label": "Allow recipients to block Sender Address",
        "name": "PermissionToBlockSender",
        "defaultValue": false,
        "required": false
      },
      {
        "type": "switch",
        "label": "Allow recipients to whitelist Sender Address",
        "name": "PermissionToAllowSender",
        "defaultValue": false,
        "required": false
      }
    ],
    "label": "Custom Quarantine Policy",
    "multiple": true,
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-05-16",
    "powershellEquivalent": "Set-QuarantinePolicy or New-QuarantinePolicy",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.IntuneWindowsDiagnostic",
    "cat": "Intune Standards",
    "tag": [],
    "helpText": "**Some features require Windows E3 or equivalent licenses** Configures Windows diagnostic data settings for Intune. Enables features like Windows update reports, device readiness reports, and driver update reports. More information can be found in [Microsoft's documentation.](https://go.microsoft.com/fwlink/?linkid=2204384)",
    "docsDescription": "Enables Windows diagnostic data in processor configuration for your Intune tenant. This setting is required for several Intune features including Windows feature update device readiness reports, compatibility risk reports, driver update reports, and update policy alerts. When enabled, your organization becomes the controller of Windows diagnostic data collected from managed devices, allowing Intune to use this data for reporting and update management features. More information can be found in [Microsoft's documentation.](https://go.microsoft.com/fwlink/?linkid=2204384)",
    "executiveText": "Enables access to Windows Update reporting and compatibility analysis features in Intune by allowing the use of Windows diagnostic data. This unlocks important capabilities like device readiness reports for feature updates, driver update reports, and proactive alerts for update failures, helping IT teams plan and monitor Windows updates more effectively across the organization.",
    "addedComponent": [
      {
        "type": "switch",
        "name": "standards.IntuneWindowsDiagnostic.areDataProcessorServiceForWindowsFeaturesEnabled",
        "label": "Enable Windows data",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.IntuneWindowsDiagnostic.hasValidWindowsLicense",
        "label": "Confirm ownership of the required Windows E3 or equivalent licenses (Enables Windows update app and driver compatibility reports)",
        "defaultValue": false
      }
    ],
    "label": "Set Intune Windows diagnostic data settings",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2026-01-27",
    "powershellEquivalent": "Graph API",
    "recommendedBy": [],
    "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"]
  },
  {
    "name": "standards.WindowsBackupRestore",
    "cat": "Intune Standards",
    "tag": [],
    "helpText": "Configures the Windows Backup and Restore enrollment setting in Intune. When enabled, users see a restore page during Windows Autopilot/OOBE that allows them to restore their apps and settings from a previous device backup. **Before you can restore a backup, a policy to enable it on devices must be set up in Settings Catalog.**",
    "docsDescription": "Configures the Windows Backup and Restore (WBfO) device enrollment setting in Intune. This feature allows users to restore apps and settings from a previous device backup during Windows setup. Enabling this shows a restore page during enrollment (OOBE) so users can migrate their workspace configuration to a new device. More information can be found in [Microsoft's documentation.](https://learn.microsoft.com/en-us/intune/intune-service/enrollment/windows-backup-restore)",
    "executiveText": "Controls the Windows Backup and Restore for Organizations feature in Intune. When enabled, employees setting up new devices can restore their apps and settings from a previous backup during Windows enrollment. This streamlines device provisioning, reduces setup time for new or replacement devices, and improves the employee experience during device transitions.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "Select value",
        "name": "standards.WindowsBackupRestore.state",
        "options": [
          { "label": "Enabled", "value": "enabled" },
          { "label": "Disabled", "value": "disabled" },
          { "label": "Not Configured", "value": "notConfigured" }
        ]
      }
    ],
    "label": "Set Windows Backup and Restore state",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2026-02-26",
    "powershellEquivalent": "Graph API",
    "recommendedBy": [],
    "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"]
  },
  {
    "name": "standards.intuneDeviceRetirementDays",
    "cat": "Intune Standards",
    "tag": [],
    "helpText": "A value between 31 and 365 is supported. retired devices are removed from Intune after the specified number of days.",
    "executiveText": "Automatically removes inactive devices from management after a specified period, helping maintain a clean device inventory and reducing security risks from abandoned or lost devices. This policy ensures that only actively used corporate devices remain in the management system.",
    "addedComponent": [
      {
        "type": "number",
        "name": "standards.intuneDeviceRetirementDays.days",
        "label": "Maximum days"
      }
    ],
    "label": "Set inactive device retirement days",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2023-05-19",
    "powershellEquivalent": "Graph API",
    "recommendedBy": ["CIPP"],
    "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"]
  },
  {
    "name": "standards.intuneBrandingProfile",
    "cat": "Intune Standards",
    "tag": [],
    "helpText": "Sets the branding profile for the Intune Company Portal app. This is a tenant wide setting and overrules any settings set on the app level.",
    "executiveText": "Customizes the Intune Company Portal app with company branding, contact information, and support details, providing employees with a consistent corporate experience when managing their devices. This improves user experience and ensures employees know how to get IT support when needed.",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.intuneBrandingProfile.displayName",
        "label": "Organization name",
        "required": false
      },
      {
        "type": "switch",
        "name": "standards.intuneBrandingProfile.showLogo",
        "label": "Show logo"
      },
      {
        "type": "switch",
        "name": "standards.intuneBrandingProfile.showDisplayNameNextToLogo",
        "label": "Show organization name next to logo",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.intuneBrandingProfile.contactITName",
        "label": "Contact IT name",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.intuneBrandingProfile.contactITPhoneNumber",
        "label": "Contact IT phone number",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.intuneBrandingProfile.contactITEmailAddress",
        "label": "Contact IT email address",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.intuneBrandingProfile.contactITNotes",
        "label": "Contact IT notes",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.intuneBrandingProfile.onlineSupportSiteName",
        "label": "Online support site name",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.intuneBrandingProfile.onlineSupportSiteUrl",
        "label": "Online support site URL",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.intuneBrandingProfile.privacyUrl",
        "label": "Privacy statement URL",
        "required": false
      }
    ],
    "label": "Set Intune Company Portal branding profile",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-06-20",
    "powershellEquivalent": "Graph API",
    "recommendedBy": [],
    "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"]
  },
  {
    "name": "standards.IntuneComplianceSettings",
    "cat": "Intune Standards",
    "tag": ["CIS M365 7.0.0 (4.1)"],
    "appliesToTest": ["CIS_4_1"],
    "helpText": "Sets the mark devices with no compliance policy assigned as compliance/non compliant and Compliance status validity period.",
    "executiveText": "Configures how the system treats devices that don't have specific compliance policies and sets how often devices must check in to maintain their compliance status. This ensures proper security oversight of all corporate devices and maintains current compliance information.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "required": true,
        "multiple": false,
        "creatable": false,
        "name": "standards.IntuneComplianceSettings.secureByDefault",
        "label": "Mark devices with no compliance policy as",
        "options": [
          { "label": "Compliant", "value": "false" },
          { "label": "Non-Compliant", "value": "true" }
        ]
      },
      {
        "type": "number",
        "name": "standards.IntuneComplianceSettings.deviceComplianceCheckinThresholdDays",
        "label": "Compliance status validity period (days)",
        "defaultValue": 120,
        "validators": {
          "min": { "value": 1, "message": "Minimum value is 1" },
          "max": { "value": 120, "message": "Maximum value is 120" }
        }
      }
    ],
    "label": "Set Intune Compliance Settings",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-11-12",
    "powershellEquivalent": "Graph API",
    "recommendedBy": [],
    "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"]
  },
  {
    "name": "standards.MDMScope",
    "cat": "Intune Standards",
    "tag": [],
    "helpText": "Configures the MDM user scope. This also sets the terms of use, discovery and compliance URL to default URLs.",
    "docsDescription": "Configures the MDM user scope. This also sets the terms of use URL, discovery URL and compliance URL to default values.",
    "executiveText": "Defines which users can enroll their devices in mobile device management, controlling access to corporate resources and applications. This setting determines the scope of device management coverage and ensures appropriate users have access to necessary business tools.",
    "addedComponent": [
      {
        "name": "appliesTo",
        "label": "MDM User Scope?",
        "type": "radio",
        "options": [
          { "label": "All", "value": "all" },
          { "label": "None", "value": "none" },
          { "label": "Custom Group", "value": "selected" }
        ]
      },
      {
        "type": "textField",
        "name": "standards.MDMScope.customGroup",
        "label": "Custom Group Name",
        "required": false
      }
    ],
    "label": "Configure MDM user scope",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-02-18",
    "powershellEquivalent": "Graph API",
    "recommendedBy": [],
    "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"]
  },
  {
    "name": "standards.DefaultPlatformRestrictions",
    "cat": "Intune Standards",
    "tag": ["CIS M365 7.0.0 (4.2)", "CISA (MS.AAD.19.1v1)"],
    "appliesToTest": ["CIS_4_2"],
    "helpText": "Sets the default platform restrictions for enrolling devices into Intune. Note: Do not block personally owned if platform is blocked.",
    "executiveText": "Controls which types of devices (iOS, Android, Windows, macOS) and ownership models (corporate vs. personal) can be enrolled in the company's device management system. This helps maintain security standards while supporting necessary business device types and usage scenarios.",
    "addedComponent": [
      {
        "type": "switch",
        "name": "standards.DefaultPlatformRestrictions.platformAndroidForWorkBlocked",
        "label": "Block platform Android Enterprise (work profile)",
        "default": false
      },
      {
        "type": "switch",
        "name": "standards.DefaultPlatformRestrictions.personalAndroidForWorkBlocked",
        "label": "Block personally owned Android Enterprise (work profile)",
        "default": false
      },
      {
        "type": "switch",
        "name": "standards.DefaultPlatformRestrictions.platformAndroidBlocked",
        "label": "Block platform Android",
        "default": false
      },
      {
        "type": "switch",
        "name": "standards.DefaultPlatformRestrictions.personalAndroidBlocked",
        "label": "Block personally owned Android",
        "default": false
      },
      {
        "type": "switch",
        "name": "standards.DefaultPlatformRestrictions.platformiOSBlocked",
        "label": "Block platform iOS",
        "default": false
      },
      {
        "type": "switch",
        "name": "standards.DefaultPlatformRestrictions.personaliOSBlocked",
        "label": "Block personally owned iOS",
        "default": false
      },
      {
        "type": "switch",
        "name": "standards.DefaultPlatformRestrictions.platformMacOSBlocked",
        "label": "Block platform macOS",
        "default": false
      },
      {
        "type": "switch",
        "name": "standards.DefaultPlatformRestrictions.personalMacOSBlocked",
        "label": "Block personally owned macOS",
        "default": false
      },
      {
        "type": "switch",
        "name": "standards.DefaultPlatformRestrictions.platformWindowsBlocked",
        "label": "Block platform Windows",
        "default": false
      },
      {
        "type": "switch",
        "name": "standards.DefaultPlatformRestrictions.personalWindowsBlocked",
        "label": "Block personally owned Windows",
        "default": false
      }
    ],
    "label": "Device enrollment restrictions",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-04-01",
    "powershellEquivalent": "Graph API",
    "recommendedBy": [],
    "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"]
  },
  {
    "name": "standards.MDMEnrollmentDuringRegistration",
    "cat": "Intune Standards",
    "tag": [],
    "helpText": "Controls the \"Allow my organization to manage my device\" prompt when adding a work or school account on Windows. This setting determines whether automatic MDM enrollment occurs during account registration.",
    "docsDescription": "Controls whether Windows shows the \"Allow my organization to manage my device\" prompt when users add a work or school account. When set to disabled, this setting prevents automatic MDM enrollment during the account registration flow, separating account registration from device enrollment. This is useful for environments where you want to allow users to add work accounts without triggering MDM enrollment.",
    "executiveText": "Controls automatic device management enrollment during work account setup. When disabled, users can add work accounts to their Windows devices without the prompt asking to allow organizational device management, preventing unintended MDM enrollments on personal or BYOD devices.",
    "addedComponent": [
      {
        "type": "switch",
        "name": "standards.MDMEnrollmentDuringRegistration.disableEnrollment",
        "label": "Disable MDM enrollment during registration"
      }
    ],
    "label": "Configure MDM enrollment when adding work or school account",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2025-12-15",
    "powershellEquivalent": "Graph API",
    "recommendedBy": [],
    "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"]
  },
  {
    "name": "standards.EnrollmentWindowsHelloForBusinessConfiguration",
    "cat": "Intune Standards",
    "tag": [],
    "helpText": "Sets the Windows Hello for Business configuration during device enrollment.",
    "executiveText": "Enables or disables Windows Hello for Business during device enrollment, enhancing security through biometric or PIN-based authentication methods. This ensures that devices meet corporate security standards while providing a user-friendly sign-in experience.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "name": "standards.EnrollmentWindowsHelloForBusinessConfiguration.state",
        "label": "Configure Windows Hello for Business",
        "multiple": false,
        "options": [
          { "label": "Not configured", "value": "notConfigured" },
          { "label": "Enabled", "value": "enabled" },
          { "label": "Disabled", "value": "disabled" }
        ]
      },
      {
        "type": "switch",
        "name": "standards.EnrollmentWindowsHelloForBusinessConfiguration.securityDeviceRequired",
        "label": "Use a Trusted Platform Module (TPM)",
        "default": true
      },
      {
        "type": "number",
        "name": "standards.EnrollmentWindowsHelloForBusinessConfiguration.pinMinimumLength",
        "label": "Minimum PIN length (4-127)",
        "default": 4,
        "validators": {
          "min": { "value": 4, "message": "Minimum value is 4" },
          "max": { "value": 127, "message": "Maximum value is 127" }
        }
      },
      {
        "type": "number",
        "name": "standards.EnrollmentWindowsHelloForBusinessConfiguration.pinMaximumLength",
        "label": "Maximum PIN length (4-127)",
        "default": 127,
        "validators": {
          "min": { "value": 4, "message": "Minimum value is 4" },
          "max": { "value": 127, "message": "Maximum value is 127" }
        }
      },
      {
        "type": "autoComplete",
        "name": "standards.EnrollmentWindowsHelloForBusinessConfiguration.pinLowercaseCharactersUsage",
        "label": "Lowercase letters in PIN",
        "multiple": false,
        "options": [
          { "label": "Not allowed", "value": "disallowed" },
          { "label": "Allowed", "value": "allowed" },
          { "label": "Required", "value": "required" }
        ]
      },
      {
        "type": "autoComplete",
        "name": "standards.EnrollmentWindowsHelloForBusinessConfiguration.pinUppercaseCharactersUsage",
        "label": "Uppercase letters in PIN",
        "multiple": false,
        "options": [
          { "label": "Not allowed", "value": "disallowed" },
          { "label": "Allowed", "value": "allowed" },
          { "label": "Required", "value": "required" }
        ]
      },
      {
        "type": "autoComplete",
        "name": "standards.EnrollmentWindowsHelloForBusinessConfiguration.pinSpecialCharactersUsage",
        "label": "Special characters in PIN",
        "multiple": false,
        "options": [
          { "label": "Not allowed", "value": "disallowed" },
          { "label": "Allowed", "value": "allowed" },
          { "label": "Required", "value": "required" }
        ]
      },
      {
        "type": "number",
        "name": "standards.EnrollmentWindowsHelloForBusinessConfiguration.pinExpirationInDays",
        "label": "PIN expiration (days) - 0 to disable",
        "default": 0
      },
      {
        "type": "number",
        "name": "standards.EnrollmentWindowsHelloForBusinessConfiguration.pinPreviousBlockCount",
        "label": "PIN history - 0 to disable",
        "default": 0
      },
      {
        "type": "switch",
        "name": "standards.EnrollmentWindowsHelloForBusinessConfiguration.unlockWithBiometricsEnabled",
        "label": "Allow biometric authentication",
        "default": true
      },
      {
        "type": "autoComplete",
        "name": "standards.EnrollmentWindowsHelloForBusinessConfiguration.enhancedBiometricsState",
        "label": "Use enhanced anti-spoofing when available",
        "multiple": false,
        "options": [
          { "label": "Not configured", "value": "notConfigured" },
          { "label": "Enabled", "value": "enabled" },
          { "label": "Disabled", "value": "disabled" }
        ]
      },
      {
        "type": "switch",
        "name": "standards.EnrollmentWindowsHelloForBusinessConfiguration.remotePassportEnabled",
        "label": "Allow phone sign-in",
        "default": true
      },
      {
        "type": "autoComplete",
        "name": "standards.EnrollmentWindowsHelloForBusinessConfiguration.enhancedSignInSecurity",
        "label": "Enable enhanced sign-in security",
        "multiple": false,
        "options": [
          { "label": "Not configured", "value": "0" },
          { "label": "Enabled on capable hardware", "value": "1" },
          { "label": "Disabled on all systems", "value": "2" }
        ]
      },
      {
        "type": "autoComplete",
        "name": "standards.EnrollmentWindowsHelloForBusinessConfiguration.securityKeyForSignIn",
        "label": "Use security keys for sign-in",
        "multiple": false,
        "options": [
          { "label": "Not configured", "value": "notConfigured" },
          { "label": "Enabled", "value": "enabled" },
          { "label": "Disabled", "value": "disabled" }
        ]
      }
    ],
    "label": "Windows Hello for Business enrollment configuration",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-09-25",
    "powershellEquivalent": "Graph API",
    "recommendedBy": [],
    "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"]
  },
  {
    "name": "standards.intuneDeviceReg",
    "cat": "Intune Standards",
    "tag": ["CIS M365 7.0.0 (5.1.4.2)", "CISA (MS.AAD.17.1v1)"],
    "appliesToTest": ["CIS_5_1_4_2", "ZTNA21801", "ZTNA21802", "ZTNA21837"],
    "helpText": "Sets the maximum number of devices that can be registered by a user. A value of 0 disables device registration by users",
    "executiveText": "Limits how many devices each employee can register for corporate access, preventing excessive device proliferation while accommodating legitimate business needs. This helps maintain security oversight and prevents potential abuse of device registration privileges.",
    "addedComponent": [
      {
        "type": "number",
        "name": "standards.intuneDeviceReg.max",
        "label": "Maximum devices (Enter 2147483647 for unlimited.)",
        "required": true
      }
    ],
    "label": "Set Maximum Number of Devices per user",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2023-03-27",
    "powershellEquivalent": "Update-MgBetaPolicyDeviceRegistrationPolicy",
    "recommendedBy": [],
    "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"]
  },
  {
    "name": "standards.intuneDeviceRegLocalAdmins",
    "cat": "Entra (AAD) Standards",
    "tag": ["CIS M365 7.0.0 (5.1.4.3)", "CIS M365 7.0.0 (5.1.4.4)", "SMB1001 (2.2)"],
    "appliesToTest": ["CIS_5_1_4_3", "CIS_5_1_4_4", "SMB1001_2_2"],
    "helpText": "Controls whether users who register Microsoft Entra joined devices are granted local administrator rights on those devices and if Global Administrators are added as local admins.",
    "docsDescription": "Configures the Device Registration Policy local administrator behavior for registering users. When enabled, users who register devices are not granted local administrator rights, you can also configure if Global Administrators are added as local admins.",
    "executiveText": "Controls whether employees who enroll devices automatically receive local administrator access. Disabling registering-user admin rights follows least-privilege principles and reduces security risk from over-privileged endpoints.",
    "addedComponent": [
      {
        "type": "switch",
        "name": "standards.intuneDeviceRegLocalAdmins.disableRegisteringUsers",
        "label": "Disable registering users as local administrators",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.intuneDeviceRegLocalAdmins.enableGlobalAdmins",
        "label": "Allow Global Administrators to be local administrators",
        "defaultValue": true
      }
    ],
    "label": "Configure local administrator rights for users joining devices",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2026-02-23",
    "powershellEquivalent": "Update-MgBetaPolicyDeviceRegistrationPolicy",
    "recommendedBy": []
  },
  {
    "name": "standards.intuneRestrictUserDeviceRegistration",
    "cat": "Entra (AAD) Standards",
    "tag": [],
    "appliesToTest": [],
    "helpText": "Controls whether users can register devices with Entra.",
    "docsDescription": "Configures whether users can register devices with Entra. When disabled, users are unable to register devices with Entra.",
    "executiveText": "Controls whether employees can register their devices for corporate access. Disabling user device registration prevents unauthorized or unmanaged devices from connecting to company resources, enhancing overall security posture.",
    "addedComponent": [
      {
        "type": "switch",
        "name": "standards.intuneRestrictUserDeviceRegistration.disableUserDeviceRegistration",
        "label": "Disable users from registering devices",
        "defaultValue": true
      }
    ],
    "label": "Configure user restriction for Entra device registration",
    "impact": "High Impact",
    "impactColour": "warning",
    "addedDate": "2026-02-23",
    "powershellEquivalent": "Update-MgBetaPolicyDeviceRegistrationPolicy",
    "recommendedBy": []
  },
  {
    "name": "standards.intuneRestrictUserDeviceJoin",
    "cat": "Entra (AAD) Standards",
    "tag": ["CIS M365 7.0.0 (5.1.4.1)", "SMB1001 (2.8)"],
    "appliesToTest": ["CIS_5_1_4_1", "SMB1001_2_8"],
    "helpText": "Controls whether users can join devices to Entra.",
    "docsDescription": "Configures whether users can join devices to Entra. When disabled, users are unable to Entra-join devices, which prevents them from creating new Entra-joined (cloud-managed) device identities.",
    "executiveText": "Controls whether employees can join their devices to the corporate Entra directory. Disabling user device join prevents unauthorized or unmanaged devices from becoming corporate-managed identities, enhancing overall security posture.",
    "addedComponent": [
      {
        "type": "switch",
        "name": "standards.intuneRestrictUserDeviceJoin.disableUserDeviceJoin",
        "label": "Disable users from joining devices",
        "defaultValue": true
      }
    ],
    "label": "Configure user restriction for Entra device join",
    "impact": "High Impact",
    "impactColour": "warning",
    "addedDate": "2026-05-15",
    "powershellEquivalent": "Update-MgBetaPolicyDeviceRegistrationPolicy",
    "recommendedBy": []
  },
  {
    "name": "standards.intuneRequireMFA",
    "cat": "Intune Standards",
    "tag": [],
    "appliesToTest": ["ZTNA21782", "ZTNA21796", "ZTNA21872"],
    "helpText": "Requires MFA for all users to register devices with Intune. This is useful when not using Conditional Access.",
    "executiveText": "Requires employees to use multi-factor authentication when registering devices for corporate access, adding an extra security layer to prevent unauthorized device enrollment. This helps ensure only legitimate users can connect their devices to company systems.",
    "label": "Require Multi-factor Authentication to register or join devices with Microsoft Entra",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2023-10-23",
    "powershellEquivalent": "Update-MgBetaPolicyDeviceRegistrationPolicy",
    "recommendedBy": []
  },
  {
    "name": "standards.DeletedUserRentention",
    "cat": "SharePoint Standards",
    "tag": ["SMB1001 (3.1)"],
    "appliesToTest": ["SMB1001_3_1"],
    "helpText": "Sets the retention period for deleted users OneDrive to the specified period of time. The default is 30 days.",
    "docsDescription": "When a OneDrive user gets deleted, the personal SharePoint site is saved for selected amount of time that data can be retrieved from it.",
    "executiveText": "Preserves departed employees' OneDrive files for a specified period, allowing time to recover important business documents before permanent deletion. This helps prevent data loss while managing storage costs and maintaining compliance with data retention policies.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "name": "standards.DeletedUserRentention.Days",
        "label": "Retention time (Default 30 days)",
        "options": [
          { "label": "30 days", "value": "30" },
          { "label": "90 days", "value": "90" },
          { "label": "1 year", "value": "365" },
          { "label": "2 years", "value": "730" },
          { "label": "3 years", "value": "1095" },
          { "label": "4 years", "value": "1460" },
          { "label": "5 years", "value": "1825" },
          { "label": "6 years", "value": "2190" },
          { "label": "7 years", "value": "2555" },
          { "label": "8 years", "value": "2920" },
          { "label": "9 years", "value": "3285" },
          { "label": "10 years", "value": "3650" }
        ]
      }
    ],
    "label": "Set deleted user retention time in OneDrive",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2022-06-15",
    "powershellEquivalent": "Update-MgBetaAdminSharePointSetting",
    "recommendedBy": [],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.SPFileRequests",
    "cat": "SharePoint Standards",
    "tag": [],
    "helpText": "Enables or disables File Requests for SharePoint and OneDrive, allowing users to create secure upload-only links. Optionally sets the maximum number of days for the link to remain active before expiring.",
    "docsDescription": "File Requests allow users to create secure upload-only share links where uploads are hidden from other people using the link. This creates a secure and private way for people to upload files to a folder. This feature is not enabled by default on new tenants and requires PowerShell configuration. This standard enables or disables this feature and optionally configures link expiration settings for both SharePoint and OneDrive.",
    "executiveText": "Enables secure file upload functionality that allows external users to submit files directly to company folders without seeing other submissions or folder contents. This provides a professional and secure way to collect documents from clients, vendors, and partners while maintaining data privacy and security.",
    "addedComponent": [
      {
        "type": "switch",
        "name": "standards.SPFileRequests.state",
        "label": "Enable File Requests"
      },
      {
        "type": "number",
        "name": "standards.SPFileRequests.expirationDays",
        "label": "Link Expiration 1-730 Days (Optional)",
        "required": false,
        "validators": {
          "min": { "value": 1, "message": "Minimum value is 1" },
          "max": { "value": 730, "message": "Maximum value is 730" }
        }
      }
    ],
    "label": "Set SharePoint and OneDrive File Requests",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2025-07-30",
    "powershellEquivalent": "Set-SPOTenant -CoreRequestFilesLinkEnabled $true -OneDriveRequestFilesLinkEnabled $true -CoreRequestFilesLinkExpirationInDays 30 -OneDriveRequestFilesLinkExpirationInDays 30",
    "recommendedBy": ["CIPP"],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.TenantDefaultTimezone",
    "cat": "SharePoint Standards",
    "tag": [],
    "helpText": "Sets the default timezone for the tenant. This will be used for all new users and sites.",
    "executiveText": "Standardizes the timezone setting across all SharePoint sites and new user accounts, ensuring consistent scheduling and time-based operations throughout the organization. This improves collaboration efficiency and reduces confusion in global or multi-timezone organizations.",
    "addedComponent": [
      {
        "type": "TimezoneSelect",
        "name": "standards.TenantDefaultTimezone.Timezone",
        "label": "Timezone"
      }
    ],
    "label": "Set Default Timezone for Tenant",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-04-20",
    "powershellEquivalent": "Update-MgBetaAdminSharePointSetting",
    "recommendedBy": [],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.SPAzureB2B",
    "cat": "SharePoint Standards",
    "tag": ["CIS M365 7.0.0 (7.2.2)"],
    "appliesToTest": ["CIS_7_2_2"],
    "helpText": "Ensure SharePoint and OneDrive integration with Azure AD B2B is enabled",
    "executiveText": "Enables secure collaboration with external partners through SharePoint and OneDrive by integrating with Azure B2B guest access. This allows controlled sharing with external organizations while maintaining security oversight and proper access management.",
    "addedComponent": [],
    "label": "Enable SharePoint and OneDrive integration with Azure AD B2B",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-07-09",
    "powershellEquivalent": "Set-SPOTenant -EnableAzureADB2BIntegration $true",
    "recommendedBy": ["CIS"],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.SPDisallowInfectedFiles",
    "cat": "SharePoint Standards",
    "tag": ["CIS M365 7.0.0 (7.3.1)", "CISA (MS.SPO.3.1v1)", "NIST CSF 2.0 (DE.CM-09)"],
    "appliesToTest": ["CIS_7_3_1", "ZTNA21817"],
    "helpText": "Ensure Office 365 SharePoint infected files are disallowed for download",
    "executiveText": "Prevents employees from downloading files that have been identified as containing malware or viruses from SharePoint and OneDrive. This security measure protects against malware distribution through file sharing while maintaining access to clean, safe documents.",
    "addedComponent": [],
    "label": "Disallow downloading infected files from SharePoint",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-07-09",
    "powershellEquivalent": "Set-SPOTenant -DisallowInfectedFileDownload $true",
    "recommendedBy": ["CIS", "CIPP"],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.SPDisableLegacyWorkflows",
    "cat": "SharePoint Standards",
    "tag": [],
    "helpText": "Disables the creation of new SharePoint 2010 and 2013 classic workflows and removes the 'Return to classic SharePoint' link on modern SharePoint list and library pages.",
    "executiveText": "Disables outdated SharePoint workflow features and classic interface options, encouraging use of modern, more secure and efficient collaboration tools. This helps maintain security standards while guiding users toward current, supported functionality.",
    "addedComponent": [],
    "label": "Disable Legacy Workflows",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-07-15",
    "powershellEquivalent": "Set-SPOTenant -DisableWorkflow2010 $true -DisableWorkflow2013 $true -DisableBackToClassic $true",
    "recommendedBy": [],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.SPDirectSharing",
    "cat": "SharePoint Standards",
    "tag": [],
    "helpText": "This standard has been deprecated in favor of the Default Sharing Link standard. ",
    "executiveText": "Configures SharePoint and OneDrive to share files directly with specific people rather than creating anonymous links, improving security by ensuring only intended recipients can access shared documents. This reduces the risk of accidental data exposure through link sharing.",
    "addedComponent": [],
    "label": "Default sharing to Direct users",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2024-07-09",
    "powershellEquivalent": "Set-SPOTenant -DefaultSharingLinkType Direct",
    "recommendedBy": ["CIS", "CIPP"],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.SPExternalUserExpiration",
    "cat": "SharePoint Standards",
    "tag": ["CIS M365 7.0.0 (7.2.9)", "CISA (MS.SPO.1.5v1)"],
    "appliesToTest": ["CIS_7_2_9", "ZTNA21803", "ZTNA21804", "ZTNA21858"],
    "helpText": "Ensure guest access to a site or OneDrive will expire automatically",
    "executiveText": "Automatically expires external user access to SharePoint sites and OneDrive after a specified period, reducing security risks from forgotten or unnecessary guest accounts. This ensures external access is regularly reviewed and maintained only when actively needed.",
    "addedComponent": [
      {
        "type": "number",
        "name": "standards.SPExternalUserExpiration.Days",
        "label": "Days until expiration (Default 60)",
        "defaultValue": 60,
        "validators": {
          "min": { "value": 1, "message": "Minimum value is 1" },
          "max": { "value": 730, "message": "Maximum value is 730" }
        }
      }
    ],
    "label": "Set guest access to expire automatically",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2024-07-09",
    "powershellEquivalent": "Set-SPOTenant -ExternalUserExpireInDays 30 -ExternalUserExpirationRequired $True",
    "recommendedBy": ["CIS"],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.SPEmailAttestation",
    "cat": "SharePoint Standards",
    "tag": ["CIS M365 7.0.0 (7.2.10)", "CISA (MS.SPO.1.6v1)"],
    "appliesToTest": ["CIS_7_2_10", "ZTNA21803", "ZTNA21804"],
    "helpText": "Ensure re-authentication with verification code is restricted",
    "executiveText": "Requires external users to periodically re-verify their identity through email verification codes when accessing SharePoint resources, adding an extra security layer for external collaboration. This helps ensure continued legitimacy of external access over time.",
    "addedComponent": [
      {
        "type": "number",
        "name": "standards.SPEmailAttestation.Days",
        "label": "Require re-authentication every X Days (Default 15)",
        "defaultValue": 15,
        "validators": {
          "min": { "value": 1, "message": "Minimum value is 1" },
          "max": { "value": 365, "message": "Maximum value is 365" }
        }
      }
    ],
    "label": "Require re-authentication with verification code",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2024-07-09",
    "powershellEquivalent": "Set-SPOTenant -EmailAttestationRequired $true -EmailAttestationReAuthDays 15",
    "recommendedBy": ["CIS", "CIPP"],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.DefaultSharingLink",
    "cat": "SharePoint Standards",
    "tag": ["CIS M365 7.0.0 (7.2.7)", "CIS M365 7.0.0 (7.2.11)", "CISA (MS.SPO.1.4v1)"],
    "appliesToTest": ["CIS_7_2_11", "CIS_7_2_7", "ZTNA21803", "ZTNA21804"],
    "helpText": "Configure the SharePoint default sharing link type and permission. This setting controls both the type of sharing link created by default and the permission level assigned to those links.",
    "docsDescription": "Sets the default sharing link type (Direct or Internal) and permission (View) in SharePoint and OneDrive. Direct sharing means links only work for specific people, while Internal sharing means links work for anyone in the organization. Setting the view permission as the default ensures that users must deliberately select the edit permission when sharing a link, reducing the risk of unintentionally granting edit privileges.",
    "executiveText": "Configures SharePoint default sharing links to implement the principle of least privilege for document sharing. This security measure reduces the risk of accidental data modification while maintaining collaboration functionality, requiring users to explicitly select Edit permissions when necessary. The sharing type setting controls whether links are restricted to specific recipients or available to the entire organization. This reduces the risk of accidental data exposure through link sharing.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "required": true,
        "label": "Default Sharing Link Type",
        "name": "standards.DefaultSharingLink.SharingLinkType",
        "options": [
          { "label": "Direct - Only the people the user specifies", "value": "Direct" },
          { "label": "Internal - Only people in your organization", "value": "Internal" }
        ]
      }
    ],
    "label": "Set Default Sharing Link Settings",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-06-13",
    "powershellEquivalent": "Set-SPOTenant -DefaultSharingLinkType [Direct|Internal] -DefaultLinkPermission View",
    "recommendedBy": ["CIS", "CIPP"],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.DisableAddShortcutsToOneDrive",
    "cat": "SharePoint Standards",
    "tag": [],
    "helpText": "If disabled, the button Add shortcut to OneDrive will be removed and users in the tenant will no longer be able to add new shortcuts to their OneDrive. Existing shortcuts will remain functional",
    "executiveText": "Controls whether employees can create shortcuts to SharePoint libraries in their OneDrive, managing how users organize and access shared content. This setting helps maintain organized file structures and can prevent confusion from excessive shortcuts while preserving existing workflows.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "Add Shortcuts To OneDrive button state",
        "name": "standards.DisableAddShortcutsToOneDrive.state",
        "options": [
          { "label": "Disabled", "value": "true" },
          { "label": "Enabled", "value": "false" }
        ]
      }
    ],
    "label": "Set Add Shortcuts To OneDrive button state",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2023-07-25",
    "powershellEquivalent": "Set-SPOTenant -DisableAddShortcutsToOneDrive $true or $false",
    "recommendedBy": [],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.SPSyncButtonState",
    "cat": "SharePoint Standards",
    "tag": [],
    "helpText": "If disabled, users in the tenant will no longer be able to use the Sync button to sync SharePoint content on all sites. However, existing synced content will remain functional on the user's computer.",
    "executiveText": "Controls whether employees can synchronize SharePoint files to their local devices, balancing productivity benefits with data security concerns. This setting helps manage data distribution while maintaining access to cloud-based collaboration when sync is disabled.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "SharePoint Sync Button state",
        "name": "standards.SPSyncButtonState.state",
        "options": [
          { "label": "Disabled", "value": "true" },
          { "label": "Enabled", "value": "false" }
        ]
      }
    ],
    "label": "Set SharePoint sync button state",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2024-07-26",
    "powershellEquivalent": "Set-SPOTenant -HideSyncButtonOnTeamSite $true or $false",
    "recommendedBy": [],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.DisableSharePointLegacyAuth",
    "cat": "SharePoint Standards",
    "tag": [
      "CIS M365 7.0.0 (7.2.1)",
      "spo_legacy_auth",
      "CISA (MS.AAD.3.1v1)",
      "NIST CSF 2.0 (PR.IR-01)"
    ],
    "appliesToTest": ["CIS_7_2_1", "ZTNA21776", "ZTNA21797"],
    "helpText": "Disables the ability to authenticate with SharePoint using legacy authentication methods. Any applications that use legacy authentication will need to be updated to use modern authentication.",
    "docsDescription": "Disables the ability for users and applications to access SharePoint via legacy basic authentication. This will likely not have any user impact, but will block systems/applications depending on basic auth or the SharePointOnlineCredentials class.",
    "executiveText": "Disables outdated authentication methods for SharePoint access, forcing applications and users to use modern, more secure authentication protocols. This significantly improves security by eliminating vulnerable authentication pathways while requiring updates to older applications.",
    "addedComponent": [],
    "label": "Disable legacy basic authentication for SharePoint",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2024-02-05",
    "powershellEquivalent": "Set-SPOTenant -LegacyAuthProtocolsEnabled $false",
    "recommendedBy": ["CIS", "CIPP"],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.sharingCapability",
    "cat": "SharePoint Standards",
    "tag": [
      "CIS M365 7.0.0 (7.2.3)",
      "CIS M365 7.0.0 (7.2.4)",
      "CISA (MS.AAD.14.1v1)",
      "CISA (MS.SPO.1.1v1)"
    ],
    "appliesToTest": ["CIS_7_2_3", "CIS_7_2_4", "ZTNA21803", "ZTNA21804"],
    "helpText": "Sets the default sharing level for OneDrive and SharePoint. This is a tenant wide setting and overrules any settings set on the site level",
    "executiveText": "Defines the organization's default policy for sharing files and folders in SharePoint and OneDrive, balancing collaboration needs with security requirements. This fundamental setting determines whether employees can share with external users, anonymous links, or only internal colleagues.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "label": "Select Sharing Level",
        "name": "standards.sharingCapability.Level",
        "options": [
          {
            "label": "Users can share only with people in the organization. No external sharing is allowed.",
            "value": "disabled"
          },
          {
            "label": "Users can share with new and existing guests. Guests must sign in or provide a verification code.",
            "value": "externalUserSharingOnly"
          },
          {
            "label": "Users can share with anyone by using links that do not require sign-in.",
            "value": "externalUserAndGuestSharing"
          },
          {
            "label": "Users can share with existing guests (those already in the directory of the organization).",
            "value": "existingExternalUserSharingOnly"
          }
        ]
      }
    ],
    "label": "Set Sharing Level for OneDrive and SharePoint",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2022-06-15",
    "powershellEquivalent": "Update-MgBetaAdminSharePointSetting",
    "recommendedBy": ["CIS", "CIPP"],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.DisableReshare",
    "cat": "SharePoint Standards",
    "tag": ["CIS M365 7.0.0 (7.2.5)", "CISA (MS.AAD.14.2v1)", "CISA (MS.SPO.1.2v1)"],
    "appliesToTest": ["CIS_7_2_5", "ZTNA21803", "ZTNA21804"],
    "helpText": "Disables the ability for external users to share files they don't own. Sharing links can only be made for People with existing access",
    "docsDescription": "Disables the ability for external users to share files they don't own. Sharing links can only be made for People with existing access. This is a tenant wide setting and overrules any settings set on the site level",
    "executiveText": "Prevents external users from sharing company documents with additional people, maintaining control over document distribution and preventing unauthorized access expansion. This security measure ensures that external sharing remains within intended boundaries set by internal employees.",
    "addedComponent": [],
    "label": "Disable Re-sharing by External Users",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2022-06-15",
    "powershellEquivalent": "Update-MgBetaAdminSharePointSetting",
    "recommendedBy": ["CIS", "CIPP"],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.DisableUserSiteCreate",
    "cat": "SharePoint Standards",
    "tag": ["SMB1001 (2.8)"],
    "appliesToTest": ["SMB1001_2_8"],
    "helpText": "Disables users from creating new SharePoint sites",
    "docsDescription": "Disables standard users from creating SharePoint sites, also disables the ability to fully create teams",
    "executiveText": "Restricts the creation of new SharePoint sites to authorized administrators, preventing uncontrolled proliferation of collaboration spaces and ensuring proper governance. This maintains organized information architecture while requiring approval for new collaborative environments.",
    "addedComponent": [],
    "label": "Disable site creation by standard users",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2022-06-15",
    "powershellEquivalent": "Update-MgAdminSharePointSetting",
    "recommendedBy": [],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.ExcludedfileExt",
    "cat": "SharePoint Standards",
    "tag": [],
    "helpText": "Sets the file extensions that are excluded from syncing with OneDrive. These files will be blocked from upload. '*.' is automatically added to the extension and can be omitted.",
    "executiveText": "Blocks specific file types from being uploaded or synchronized to OneDrive, helping prevent security risks from potentially dangerous file formats. This security measure protects against malware distribution while allowing legitimate business file types to be shared safely.",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.ExcludedfileExt.ext",
        "label": "Extensions, Comma separated"
      }
    ],
    "label": "Exclude File Extensions from Syncing",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2022-06-15",
    "powershellEquivalent": "Update-MgAdminSharePointSetting",
    "recommendedBy": [],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.disableMacSync",
    "cat": "SharePoint Standards",
    "tag": [],
    "helpText": "Disables the ability for Mac devices to sync with OneDrive.",
    "executiveText": "Prevents Mac computers from synchronizing files with OneDrive, typically implemented for security or compliance reasons in Windows-centric environments. This restriction helps maintain standardized device management while potentially limiting collaboration for Mac users.",
    "addedComponent": [],
    "label": "Do not allow Mac devices to sync using OneDrive",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2022-06-15",
    "powershellEquivalent": "Update-MgAdminSharePointSetting",
    "recommendedBy": [],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.unmanagedSync",
    "cat": "SharePoint Standards",
    "tag": ["CISA (MS.SPO.2.1v1)", "NIST CSF 2.0 (PR.AA-05)"],
    "appliesToTest": ["ZTNA24824"],
    "helpText": "Entra P1 required. Block or limit access to SharePoint and OneDrive content from unmanaged devices (those not hybrid AD joined or compliant in Intune). These controls rely on Microsoft Entra Conditional Access policies and can take up to 24 hours to take effect.",
    "docsDescription": "Entra P1 required. Block or limit access to SharePoint and OneDrive content from unmanaged devices (those not hybrid AD joined or compliant in Intune). These controls rely on Microsoft Entra Conditional Access policies and can take up to 24 hours to take effect. 0 = Allow Access, 1 = Allow limited, web-only access, 2 = Block access. All information about this can be found in Microsofts documentation [here.](https://learn.microsoft.com/en-us/sharepoint/control-access-from-unmanaged-devices)",
    "executiveText": "Restricts access to company files from personal or unmanaged devices, ensuring corporate data can only be accessed from properly secured and monitored devices. This critical security control prevents data leaks while allowing controlled access through web browsers when necessary.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "name": "standards.unmanagedSync.state",
        "label": "State",
        "options": [
          { "label": "Allow limited, web-only access", "value": "1" },
          { "label": "Block access", "value": "2" }
        ],
        "required": false
      }
    ],
    "label": "Restrict access to SharePoint and OneDrive from unmanaged devices",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2025-06-13",
    "powershellEquivalent": "Set-SPOTenant -ConditionalAccessPolicy AllowFullAccess | AllowLimitedAccess | BlockAccess",
    "recommendedBy": ["CIS"],
    "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"]
  },
  {
    "name": "standards.sharingDomainRestriction",
    "cat": "SharePoint Standards",
    "tag": ["CIS M365 7.0.0 (7.2.6)", "CISA (MS.AAD.14.3v1)", "CISA (MS.SPO.1.3v1)"],
    "appliesToTest": ["CIS_7_2_6", "ZTNA21803", "ZTNA21804"],
    "helpText": "Restricts sharing to only users with the specified domain. This is useful for organizations that only want to share with their own domain.",
    "executiveText": "Controls which external domains employees can share files with, enabling secure collaboration with trusted partners while blocking sharing with unauthorized organizations. This targeted approach maintains necessary business relationships while preventing data exposure to unknown entities.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "name": "standards.sharingDomainRestriction.Mode",
        "label": "Limit external sharing by domains",
        "options": [
          { "label": "Off", "value": "none" },
          { "label": "Restrict sharing to specific domains", "value": "allowList" },
          { "label": "Block sharing to specific domains", "value": "blockList" }
        ]
      },
      {
        "type": "textField",
        "name": "standards.sharingDomainRestriction.Domains",
        "label": "Domains to allow/block, comma separated",
        "required": false
      }
    ],
    "label": "Restrict sharing to a specific domain",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2024-06-20",
    "powershellEquivalent": "Update-MgAdminSharePointSetting",
    "recommendedBy": [],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.TeamsGlobalMeetingPolicy",
    "cat": "Teams Standards",
    "tag": [
      "CIS M365 7.0.0 (8.5.1)",
      "CIS M365 7.0.0 (8.5.2)",
      "CIS M365 7.0.0 (8.5.3)",
      "CIS M365 7.0.0 (8.5.4)",
      "CIS M365 7.0.0 (8.5.5)",
      "CIS M365 7.0.0 (8.5.6)",
      "CIS M365 7.0.0 (8.5.7)",
      "CIS M365 7.0.0 (8.5.8)",
      "CIS M365 7.0.0 (8.5.9)"
    ],
    "appliesToTest": [
      "CIS_8_5_1",
      "CIS_8_5_2",
      "CIS_8_5_3",
      "CIS_8_5_4",
      "CIS_8_5_5",
      "CIS_8_5_6",
      "CIS_8_5_7",
      "CIS_8_5_8",
      "CIS_8_5_9"
    ],
    "helpText": "Defines the CIS recommended global meeting policy for Teams. This includes AllowAnonymousUsersToJoinMeeting, AllowAnonymousUsersToStartMeeting, AutoAdmittedUsers, AllowPSTNUsersToBypassLobby, MeetingChatEnabledType, DesignatedPresenterRoleMode, AllowExternalParticipantGiveRequestControl, AllowParticipantGiveRequestControl",
    "executiveText": "Establishes security-focused default settings for Teams meetings, controlling who can join meetings, present content, and participate in chats. These policies balance collaboration needs with security requirements, ensuring meetings remain productive while protecting against unauthorized access and disruption.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "required": true,
        "multiple": false,
        "creatable": false,
        "name": "standards.TeamsGlobalMeetingPolicy.DesignatedPresenterRoleMode",
        "label": "Default value of the `Who can present?`",
        "options": [
          { "label": "Everyone", "value": "EveryoneUserOverride" },
          { "label": "People in my organization", "value": "EveryoneInCompanyUserOverride" },
          {
            "label": "People in my organization and trusted organizations",
            "value": "EveryoneInSameAndFederatedCompanyUserOverride"
          },
          { "label": "Only organizer", "value": "OrganizerOnlyUserOverride" }
        ]
      },
      {
        "type": "switch",
        "name": "standards.TeamsGlobalMeetingPolicy.AllowAnonymousUsersToJoinMeeting",
        "label": "Allow anonymous users to join meeting"
      },
      {
        "type": "switch",
        "name": "standards.TeamsGlobalMeetingPolicy.AllowAnonymousUsersToStartMeeting",
        "label": "Allow anonymous users to start meeting"
      },
      {
        "type": "autoComplete",
        "required": false,
        "multiple": false,
        "creatable": false,
        "name": "standards.TeamsGlobalMeetingPolicy.AutoAdmittedUsers",
        "label": "Who can bypass the lobby?",
        "helperText": "If left blank, the current value will not be changed.",
        "options": [
          { "label": "Only organizers and co-organizers", "value": "OrganizerOnly" },
          {
            "label": "People in organization excluding guests",
            "value": "EveryoneInCompanyExcludingGuests"
          },
          {
            "label": "People in same or federated organizations",
            "value": "EveryoneInSameAndFederatedCompany"
          },
          { "label": "People who were invited", "value": "InvitedUsers" },
          { "label": "Everyone", "value": "Everyone" }
        ]
      },
      {
        "type": "switch",
        "name": "standards.TeamsGlobalMeetingPolicy.AllowPSTNUsersToBypassLobby",
        "label": "Allow dial-in users to bypass lobby"
      },
      {
        "type": "autoComplete",
        "required": true,
        "multiple": false,
        "creatable": false,
        "name": "standards.TeamsGlobalMeetingPolicy.MeetingChatEnabledType",
        "label": "Meeting chat policy",
        "options": [
          { "label": "On for everyone", "value": "Enabled" },
          { "label": "On for everyone but anonymous users", "value": "EnabledExceptAnonymous" },
          { "label": "Off for everyone", "value": "Disabled" }
        ]
      },
      {
        "type": "switch",
        "name": "standards.TeamsGlobalMeetingPolicy.AllowParticipantGiveRequestControl",
        "label": "Participants can give or request control"
      },
      {
        "type": "switch",
        "name": "standards.TeamsGlobalMeetingPolicy.AllowExternalParticipantGiveRequestControl",
        "label": "External participants can give or request control"
      }
    ],
    "label": "Define Global Meeting Policy for Teams",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-11-12",
    "powershellEquivalent": "Set-CsTeamsMeetingPolicy -AllowAnonymousUsersToJoinMeeting $false -AllowAnonymousUsersToStartMeeting $false -AutoAdmittedUsers $AutoAdmittedUsers -AllowPSTNUsersToBypassLobby $false -MeetingChatEnabledType EnabledExceptAnonymous -DesignatedPresenterRoleMode $DesignatedPresenterRoleMode -AllowExternalParticipantGiveRequestControl $false -AllowParticipantGiveRequestControl $false",
    "recommendedBy": ["CIS"],
    "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"]
  },
  {
    "name": "standards.TeamsChatProtection",
    "cat": "Teams Standards",
    "tag": [],
    "helpText": "Configures Teams chat protection settings including weaponizable file protection and malicious URL protection.",
    "docsDescription": "Configures Teams messaging safety features to protect users from weaponizable files and malicious URLs in chats and channels. Weaponizable File Protection automatically blocks messages containing potentially dangerous file types (like .exe, .dll, .bat, etc.). Malicious URL Protection scans URLs in messages and displays warnings when potentially harmful links are detected. These protections work across internal and external collaboration scenarios.",
    "executiveText": "Enables automated security protections in Microsoft Teams to block dangerous files and warn users about malicious links in chat messages. This helps protect employees from file-based attacks and phishing attempts. These safeguards work seamlessly in the background, providing essential protection without disrupting normal business communication.",
    "addedComponent": [
      {
        "type": "switch",
        "name": "standards.TeamsChatProtection.FileTypeCheck",
        "label": "Enable Weaponizable File Protection",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.TeamsChatProtection.UrlReputationCheck",
        "label": "Enable Malicious URL Protection",
        "defaultValue": true
      }
    ],
    "label": "Set Teams Chat Protection Settings",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-10-02",
    "powershellEquivalent": "Set-CsTeamsMessagingConfiguration -FileTypeCheck 'Enabled' -UrlReputationCheck 'Enabled' -ReportIncorrectSecurityDetections 'Enabled'",
    "recommendedBy": ["CIPP"],
    "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"]
  },
  {
    "name": "standards.TeamsExternalChatWithAnyone",
    "cat": "Teams Standards",
    "tag": ["CIS M365 7.0.0 (8.2.3)"],
    "appliesToTest": ["CIS_8_2_3"],
    "helpText": "Controls whether users can start Teams chats with any email address, inviting external recipients as guests via email.",
    "docsDescription": "Manages the Teams messaging policy setting UseB2BInvitesToAddExternalUsers. When enabled, users can start chats with any email address and recipients receive an invitation to join the chat as guests. Disabling the setting prevents these external email chats from being created, keeping conversations limited to internal users and approved guests.",
    "executiveText": "Allows organizations to decide if employees can launch Microsoft Teams chats with anyone on the internet using just an email address. Disabling the feature keeps conversations inside trusted boundaries and helps prevent accidental data exposure through unexpected external invitations.",
    "addedComponent": [
      {
        "type": "radio",
        "name": "standards.TeamsExternalChatWithAnyone.UseB2BInvitesToAddExternalUsers",
        "label": "Allow chatting with anyone via email",
        "options": [
          { "label": "Enabled", "value": "true" },
          { "label": "Disabled", "value": "false" }
        ],
        "defaultValue": "Disabled"
      }
    ],
    "label": "Set Teams chat with anyone setting",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-11-03",
    "powershellEquivalent": "Set-CsTeamsMessagingPolicy -Identity Global -UseB2BInvitesToAddExternalUsers $false/$true",
    "recommendedBy": ["CIPP"],
    "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"]
  },
  {
    "name": "standards.TeamsEmailIntegration",
    "cat": "Teams Standards",
    "helpText": "Should users be allowed to send emails directly to a channel email addresses?",
    "docsDescription": "Teams channel email addresses are an optional feature that allows users to email the Teams channel directly.",
    "executiveText": "Controls whether Teams channels can receive emails directly, enabling integration between email and team collaboration. This feature can improve workflow efficiency by allowing external communications to flow into team discussions, though it may need management for security or organizational reasons.",
    "addedComponent": [
      {
        "type": "switch",
        "name": "standards.TeamsEmailIntegration.AllowEmailIntoChannel",
        "label": "Allow channel emails"
      }
    ],
    "label": "Disallow emails to be sent to channel email addresses",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-07-30",
    "powershellEquivalent": "Set-CsTeamsClientConfiguration -AllowEmailIntoChannel $false",
    "recommendedBy": ["CIS"],
    "tag": ["CIS M365 7.0.0 (8.1.2)"],
    "appliesToTest": ["CIS_8_1_2"],
    "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"]
  },
  {
    "name": "standards.TeamsGuestAccess",
    "cat": "Teams Standards",
    "tag": [],
    "helpText": "Allow guest users access to teams.",
    "docsDescription": "Allow guest users access to teams. Guest users are users who are not part of your organization but have been invited to collaborate with your organization in Teams. This setting allows you to control whether guest users can access Teams.",
    "executiveText": "Determines whether external partners, vendors, and collaborators can be invited to participate in Teams conversations and meetings. This fundamental setting enables external collaboration while requiring careful management to balance openness with security and information protection.",
    "addedComponent": [
      {
        "type": "switch",
        "name": "standards.TeamsGuestAccess.AllowGuestUser",
        "label": "Allow guest users"
      }
    ],
    "label": "Allow guest users in Teams",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-06-03",
    "powershellEquivalent": "Set-CsTeamsClientConfiguration -AllowGuestUser $true",
    "recommendedBy": [],
    "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"]
  },
  {
    "name": "standards.TeamsMeetingVerification",
    "cat": "Teams Standards",
    "tag": [],
    "helpText": "Configures CAPTCHA verification for external users joining Teams meetings. This helps prevent unauthorized AI notetakers and bots from joining meetings.",
    "docsDescription": "Configures CAPTCHA verification for external users joining Teams meetings. This security feature requires external participants to complete a CAPTCHA challenge before joining, which helps prevent unauthorized AI notetakers, bots, and other automated systems from accessing meetings.",
    "executiveText": "Requires external meeting participants to complete verification challenges before joining Teams meetings, preventing automated bots and unauthorized AI systems from accessing confidential discussions. This security measure protects against meeting infiltration while maintaining legitimate external collaboration.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "label": "CAPTCHA Verification Setting",
        "name": "standards.TeamsMeetingVerification.CaptchaVerificationForMeetingJoin",
        "options": [
          { "label": "Not Required", "value": "NotRequired" },
          {
            "label": "Anonymous Users and Untrusted Organizations",
            "value": "AnonymousUsersAndUntrustedOrganizations"
          }
        ]
      }
    ],
    "label": "Teams Meeting Verification (CAPTCHA)",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-06-14",
    "powershellEquivalent": "Set-CsTeamsMeetingPolicy -CaptchaVerificationForMeetingJoin",
    "recommendedBy": ["CIPP"],
    "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"]
  },
  {
    "name": "standards.TeamsExternalFileSharing",
    "cat": "Teams Standards",
    "tag": ["CIS M365 7.0.0 (8.1.1)"],
    "appliesToTest": ["CIS_8_1_1"],
    "helpText": "Ensure external file sharing in Teams is enabled for only approved cloud storage services.",
    "executiveText": "Controls which external cloud storage services (like Google Drive, Dropbox, Box) employees can access through Teams, ensuring file sharing occurs only through approved and secure platforms. This helps maintain data governance while supporting necessary business integrations.",
    "addedComponent": [
      {
        "type": "switch",
        "name": "standards.TeamsExternalFileSharing.AllowGoogleDrive",
        "label": "Allow Google Drive"
      },
      {
        "type": "switch",
        "name": "standards.TeamsExternalFileSharing.AllowShareFile",
        "label": "Allow ShareFile"
      },
      {
        "type": "switch",
        "name": "standards.TeamsExternalFileSharing.AllowBox",
        "label": "Allow Box"
      },
      {
        "type": "switch",
        "name": "standards.TeamsExternalFileSharing.AllowDropBox",
        "label": "Allow Dropbox"
      },
      {
        "type": "switch",
        "name": "standards.TeamsExternalFileSharing.AllowEgnyte",
        "label": "Allow Egnyte"
      }
    ],
    "label": "Define approved cloud storage services for external file sharing in Teams",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-07-28",
    "powershellEquivalent": "Set-CsTeamsClientConfiguration -AllowGoogleDrive $false -AllowShareFile $false -AllowBox $false -AllowDropBox $false -AllowEgnyte $false",
    "recommendedBy": ["CIS"],
    "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"]
  },
  {
    "name": "standards.TeamsEnrollUser",
    "cat": "Teams Standards",
    "tag": [],
    "helpText": "Controls whether users with this policy can set the voice profile capture and enrollment through the Recognition tab in their Teams client settings.",
    "docsDescription": "Controls whether users with this policy can set the voice profile capture and enrollment through the Recognition tab in their Teams client settings.",
    "executiveText": "Determines whether employees can enroll their voice and face profiles for recognition features in Teams, enabling personalized experiences like voice identification. This setting balances convenience features with privacy considerations and organizational policies regarding biometric data collection.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "required": true,
        "multiple": false,
        "creatable": false,
        "name": "standards.TeamsEnrollUser.EnrollUserOverride",
        "label": "Voice and Face Enrollment",
        "options": [
          { "label": "Disabled", "value": "Disabled" },
          { "label": "Enabled", "value": "Enabled" }
        ]
      }
    ],
    "label": "Default voice and face enrollment",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2024-11-12",
    "powershellEquivalent": "Set-CsTeamsMeetingPolicy -Identity Global -EnrollUserOverride $false",
    "recommendedBy": [],
    "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"]
  },
  {
    "name": "standards.TeamsExternalAccessPolicy",
    "cat": "Teams Standards",
    "tag": ["CIS M365 7.0.0 (8.2.1)", "CIS M365 7.0.0 (8.2.2)"],
    "appliesToTest": ["CIS_8_2_1", "CIS_8_2_2"],
    "helpText": "Sets the properties of the Global external access policy.",
    "docsDescription": "Sets the properties of the Global external access policy. External access policies determine whether or not your users can: 1) communicate with users who have Session Initiation Protocol (SIP) accounts with a federated organization; 2) communicate with users who are using custom applications built with Azure Communication Services; 3) access Skype for Business Server over the Internet, without having to log on to your internal network; 4) communicate with users who have SIP accounts with a public instant messaging (IM) provider such as Skype; and, 5) communicate with people who are using Teams with an account that's not managed by an organization.",
    "executiveText": "Defines the organization's policy for communicating with external users through Teams, including other organizations, Skype users, and unmanaged accounts. This fundamental setting determines the scope of external collaboration while maintaining security boundaries for business communications.",
    "addedComponent": [
      {
        "type": "switch",
        "name": "standards.TeamsExternalAccessPolicy.EnableFederationAccess",
        "label": "Allow communication from trusted organizations"
      },
      {
        "type": "switch",
        "name": "standards.TeamsExternalAccessPolicy.EnableTeamsConsumerAccess",
        "label": "Allow communication with unmanaged Teams accounts"
      }
    ],
    "label": "External Access Settings for Microsoft Teams",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2024-07-30",
    "powershellEquivalent": "Set-CsExternalAccessPolicy",
    "recommendedBy": [],
    "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"]
  },
  {
    "name": "standards.TeamsFederationConfiguration",
    "cat": "Teams Standards",
    "tag": ["CIS M365 7.0.0 (8.2.1)"],
    "appliesToTest": ["CIS_8_2_1", "CIS_8_2_4"],
    "helpText": "Sets the properties of the Global federation configuration.",
    "docsDescription": "Sets the properties of the Global federation configuration. Federation configuration settings determine whether or not your users can communicate with users who have SIP accounts with a federated organization.",
    "executiveText": "Configures how the organization federates with external organizations for Teams communication, controlling whether employees can communicate with specific external domains or all external organizations. This setting enables secure inter-organizational collaboration while maintaining control over external communications.",
    "addedComponent": [
      {
        "type": "switch",
        "name": "standards.TeamsFederationConfiguration.AllowTeamsConsumer",
        "label": "Allow users to communicate with other organizations"
      },
      {
        "type": "autoComplete",
        "required": true,
        "multiple": false,
        "creatable": false,
        "name": "standards.TeamsFederationConfiguration.DomainControl",
        "label": "Communication Mode",
        "options": [
          { "label": "Allow all external domains", "value": "AllowAllExternal" },
          { "label": "Block all external domains", "value": "BlockAllExternal" },
          { "label": "Allow specific external domains", "value": "AllowSpecificExternal" },
          { "label": "Block specific external domains", "value": "BlockSpecificExternal" }
        ]
      },
      {
        "type": "textField",
        "name": "standards.TeamsFederationConfiguration.DomainList",
        "label": "Domains, Comma separated",
        "required": false,
        "condition": {
          "field": "standards.TeamsFederationConfiguration.DomainControl.value",
          "compareType": "isOneOf",
          "compareValue": ["AllowSpecificExternal", "BlockSpecificExternal"]
        }
      }
    ],
    "label": "Federation Configuration for Microsoft Teams",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2024-07-31",
    "powershellEquivalent": "Set-CsTenantFederationConfiguration",
    "recommendedBy": [],
    "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"]
  },
  {
    "name": "standards.TeamsMeetingRecordingExpiration",
    "cat": "Teams Standards",
    "tag": [],
    "helpText": "Sets the default number of days after which Teams meeting recordings automatically expire. Valid values are -1 (Never Expire) or between 1 and 99999. The default value is 120 days.",
    "docsDescription": "Allows administrators to configure a default expiration period (in days) for Teams meeting recordings. Recordings older than this period will be automatically moved to the recycle bin. This setting helps manage storage consumption and enforce data retention policies.",
    "executiveText": "Automatically removes old Teams meeting recordings after a specified period to manage storage costs and comply with data retention policies. This helps organizations balance the need to preserve important meeting content with storage efficiency and regulatory compliance requirements.",
    "addedComponent": [
      {
        "type": "number",
        "name": "standards.TeamsMeetingRecordingExpiration.ExpirationDays",
        "label": "Recording Expiration Days (e.g., 365)",
        "required": true,
        "defaultValue": 120,
        "validators": {
          "min": { "value": -1, "message": "Minimum value is -1" },
          "max": { "value": 99999, "message": "Maximum value is 99999" }
        }
      }
    ],
    "label": "Set Teams Meeting Recording Expiration",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2025-04-17",
    "powershellEquivalent": "Set-CsTeamsMeetingPolicy -Identity Global -MeetingRecordingExpirationDays <days>",
    "recommendedBy": [],
    "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"]
  },
  {
    "name": "standards.TeamsMessagingPolicy",
    "cat": "Teams Standards",
    "tag": ["CIS M365 7.0.0 (8.6.1)"],
    "appliesToTest": ["CIS_8_6_1"],
    "helpText": "Sets the properties of the Global messaging policy.",
    "docsDescription": "Sets the properties of the Global messaging policy. Messaging policies control which chat and channel messaging features are available to users in Teams.",
    "executiveText": "Defines what messaging capabilities employees have in Teams, including the ability to edit or delete messages, create custom emojis, and report inappropriate content. These policies help maintain professional communication standards while enabling necessary collaboration features.",
    "addedComponent": [
      {
        "type": "switch",
        "name": "standards.TeamsMessagingPolicy.AllowOwnerDeleteMessage",
        "label": "Allow Owner to Delete Messages",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.TeamsMessagingPolicy.AllowUserDeleteMessage",
        "label": "Allow User to Delete Messages",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.TeamsMessagingPolicy.AllowUserEditMessage",
        "label": "Allow User to Edit Messages",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.TeamsMessagingPolicy.AllowUserDeleteChat",
        "label": "Allow User to Delete Chats",
        "defaultValue": true
      },
      {
        "type": "autoComplete",
        "required": true,
        "multiple": false,
        "creatable": false,
        "name": "standards.TeamsMessagingPolicy.ReadReceiptsEnabledType",
        "label": "Read Receipts Enabled Type",
        "options": [
          { "label": "User controlled", "value": "UserPreference" },
          { "label": "Turned on for everyone", "value": "Everyone" },
          { "label": "Turned off for everyone", "value": "None" }
        ]
      },
      {
        "type": "switch",
        "name": "standards.TeamsMessagingPolicy.CreateCustomEmojis",
        "label": "Allow Creating Custom Emojis",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.TeamsMessagingPolicy.DeleteCustomEmojis",
        "label": "Allow Deleting Custom Emojis",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.TeamsMessagingPolicy.AllowSecurityEndUserReporting",
        "label": "Allow reporting message as security concern",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.TeamsMessagingPolicy.AllowCommunicationComplianceEndUserReporting",
        "label": "Allow reporting message as inappropriate content",
        "defaultValue": true
      }
    ],
    "label": "Global Messaging Policy for Microsoft Teams",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2025-01-10",
    "powershellEquivalent": "Set-CsTeamsMessagingPolicy",
    "recommendedBy": [],
    "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"]
  },
  {
    "name": "standards.AutopilotStatusPage",
    "cat": "Device Management Standards",
    "tag": [],
    "disabledFeatures": { "report": false, "warn": false, "remediate": false },
    "helpText": "Deploy the Autopilot Status Page, which shows progress during device setup through Autopilot.",
    "docsDescription": "This standard allows configuration of the Autopilot Status Page, providing users with a visual representation of the progress during device setup. It includes options like timeout, logging, and retry settings.",
    "executiveText": "Provides employees with a visual progress indicator during automated device setup, improving the user experience when receiving new computers. This reduces IT support calls and helps ensure successful device deployment by guiding users through the setup process.",
    "addedComponent": [
      {
        "type": "number",
        "name": "standards.AutopilotStatusPage.TimeOutInMinutes",
        "label": "Timeout in minutes",
        "defaultValue": 60,
        "validators": {
          "min": { "value": 1, "message": "Minimum value is 1" },
          "max": { "value": 1440, "message": "Maximum value is 1440" }
        }
      },
      {
        "type": "textField",
        "name": "standards.AutopilotStatusPage.ErrorMessage",
        "label": "Custom Error Message",
        "required": false
      },
      {
        "type": "switch",
        "name": "standards.AutopilotStatusPage.ShowProgress",
        "label": "Show progress to users",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.AutopilotStatusPage.EnableLog",
        "label": "Turn on log collection",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.AutopilotStatusPage.OBEEOnly",
        "label": "Show status page only with OOBE setup",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.AutopilotStatusPage.InstallWindowsUpdates",
        "label": "Install Windows Updates during setup",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.AutopilotStatusPage.BlockDevice",
        "label": "Block device usage during setup",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.AutopilotStatusPage.AllowReset",
        "label": "Allow reset",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.AutopilotStatusPage.AllowFail",
        "label": "Allow users to use device if setup fails",
        "defaultValue": true
      }
    ],
    "label": "Enable Autopilot Status Page",
    "impact": "Low Impact",
    "addedDate": "2023-12-30",
    "impactColour": "info",
    "recommendedBy": [],
    "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"]
  },
  {
    "name": "standards.AutopilotProfile",
    "cat": "Device Management Standards",
    "tag": ["SMB1001 (2.2)"],
    "appliesToTest": ["SMB1001_2_2"],
    "disabledFeatures": { "report": false, "warn": false, "remediate": false },
    "helpText": "Assign the appropriate Autopilot profile to streamline device deployment.",
    "docsDescription": "This standard allows the deployment of Autopilot profiles to devices, including settings such as unique name templates, language options, and local admin privileges.",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.AutopilotProfile.DisplayName",
        "label": "Profile Display Name"
      },
      {
        "type": "textField",
        "name": "standards.AutopilotProfile.Description",
        "label": "Profile Description"
      },
      {
        "type": "textField",
        "name": "standards.AutopilotProfile.DeviceNameTemplate",
        "label": "Unique Device Name Template",
        "required": false
      },
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "required": false,
        "name": "standards.AutopilotProfile.Languages",
        "label": "Languages",
        "api": { "url": "/languageList.json", "labelField": "languageTag", "valueField": "tag" }
      },
      {
        "type": "switch",
        "name": "standards.AutopilotProfile.CollectHash",
        "label": "Convert all targeted devices to Autopilot",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.AutopilotProfile.AssignToAllDevices",
        "label": "Assign to all devices",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.AutopilotProfile.SelfDeployingMode",
        "label": "Enable Self-deploying Mode",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.AutopilotProfile.HideTerms",
        "label": "Hide Terms and Conditions",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.AutopilotProfile.HidePrivacy",
        "label": "Hide Privacy Settings",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.AutopilotProfile.HideChangeAccount",
        "label": "Hide Change Account Options",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.AutopilotProfile.NotLocalAdmin",
        "label": "Setup user as a standard user (not local admin)",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.AutopilotProfile.AllowWhiteGlove",
        "label": "Allow White Glove OOBE",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.AutopilotProfile.AutoKeyboard",
        "label": "Automatically configure keyboard",
        "defaultValue": true
      }
    ],
    "label": "Enable Autopilot Profile",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2023-12-30",
    "recommendedBy": [],
    "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"]
  },
  {
    "name": "standards.DevicePrepProfile",
    "cat": "Device Management Standards",
    "tag": ["autopilot", "device_prep", "enrollment"],
    "disabledFeatures": { "report": false, "warn": false, "remediate": false },
    "helpText": "Creates and manages a Windows Autopilot Device Preparation profile for streamlined device enrollment.",
    "docsDescription": "Deploys a Windows Autopilot Device Preparation profile through Intune configuration policies. This standard manages deployment mode, join type, account type, timeout, error messages, and optional device security group assignment. Optionally creates a new security group with the Intune Provisioning Client as owner.",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.DevicePrepProfile.ProfileName",
        "label": "Profile Display Name",
        "required": true
      },
      {
        "type": "textField",
        "name": "standards.DevicePrepProfile.ProfileDescription",
        "label": "Profile Description",
        "required": false
      },
      {
        "type": "select",
        "multiple": false,
        "name": "standards.DevicePrepProfile.DeploymentType",
        "label": "Deployment Type",
        "options": [
          { "label": "Single user", "value": "0" },
          { "label": "Shared", "value": "1" }
        ]
      },
      {
        "type": "select",
        "multiple": false,
        "name": "standards.DevicePrepProfile.JoinType",
        "label": "Join Type",
        "options": [
          { "label": "Microsoft Entra join", "value": "0" },
          { "label": "Microsoft Entra hybrid join", "value": "1" }
        ]
      },
      {
        "type": "select",
        "multiple": false,
        "name": "standards.DevicePrepProfile.AccountType",
        "label": "Account Type",
        "options": [
          { "label": "Standard user", "value": "0" },
          { "label": "Administrator", "value": "1" }
        ]
      },
      {
        "type": "number",
        "name": "standards.DevicePrepProfile.Timeout",
        "label": "Timeout (minutes)",
        "defaultValue": 60
      },
      {
        "type": "textField",
        "name": "standards.DevicePrepProfile.CustomErrorMessage",
        "label": "Custom Error Message",
        "required": false
      },
      {
        "type": "switch",
        "name": "standards.DevicePrepProfile.AllowSkip",
        "label": "Allow users to skip setup after failure",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.DevicePrepProfile.AllowDiagnostics",
        "label": "Allow users to collect diagnostics",
        "defaultValue": false
      },
      {
        "type": "textField",
        "name": "standards.DevicePrepProfile.DeviceGroupName",
        "label": "Device Security Group Name (wildcard match)",
        "required": false
      },
      {
        "type": "switch",
        "name": "standards.DevicePrepProfile.CreateNewGroup",
        "label": "Create new group if group is not found",
        "defaultValue": false
      },
      {
        "type": "radio",
        "name": "standards.DevicePrepProfile.AssignTo",
        "label": "Policy Assignment",
        "options": [
          { "label": "Do not assign", "value": "none" },
          { "label": "All devices", "value": "AllDevices" },
          { "label": "All users and devices", "value": "AllDevicesAndUsers" }
        ]
      }
    ],
    "label": "Deploy Device Prep Profile",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2026-05-25",
    "recommendedBy": [],
    "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"]
  },
  {
    "name": "standards.IntuneTemplate",
    "cat": "Templates",
    "label": "Intune Template",
    "multiple": true,
    "disabledFeatures": { "report": false, "warn": false, "remediate": false },
    "impact": "High Impact",
    "addedDate": "2023-12-30",
    "tag": [
      "SMB1001 (1.2)",
      "SMB1001 (1.3)",
      "SMB1001 (1.4)",
      "SMB1001 (1.8)",
      "SMB1001 (1.9)",
      "SMB1001 (1.10)",
      "SMB1001 (1.12)",
      "SMB1001 (2.2)",
      "SMB1001 (4.7)"
    ],
    "appliesToTest": [
      "SMB1001_1_10",
      "SMB1001_1_12",
      "SMB1001_1_2",
      "SMB1001_1_3",
      "SMB1001_1_4",
      "SMB1001_1_8",
      "SMB1001_1_9",
      "SMB1001_2_2",
      "SMB1001_4_7",
      "ZTNA24540",
      "ZTNA24541",
      "ZTNA24542",
      "ZTNA24543",
      "ZTNA24545",
      "ZTNA24547",
      "ZTNA24548",
      "ZTNA24549",
      "ZTNA24550",
      "ZTNA24552",
      "ZTNA24553",
      "ZTNA24564",
      "ZTNA24568",
      "ZTNA24569",
      "ZTNA24572",
      "ZTNA24574",
      "ZTNA24575",
      "ZTNA24576",
      "ZTNA24784",
      "ZTNA24839",
      "ZTNA24840",
      "ZTNA24870"
    ],
    "helpText": "Deploy and manage Intune templates across devices.",
    "executiveText": "Deploys standardized device management configurations across all corporate devices, ensuring consistent security policies, application settings, and compliance requirements. This template-based approach streamlines device management while maintaining uniform security standards across the organization.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "required": false,
        "name": "TemplateList",
        "label": "Select Intune Template",
        "api": {
          "queryKey": "ListIntuneTemplates-autcomplete",
          "url": "/api/ListIntuneTemplates",
          "labelField": "Displayname",
          "valueField": "GUID",
          "showRefresh": true,
          "templateView": { "title": "Intune Template", "property": "RAWJson", "type": "intune" }
        }
      },
      {
        "type": "autoComplete",
        "multiple": false,
        "required": false,
        "creatable": false,
        "name": "TemplateList-Tags",
        "label": "Or select a package of Intune Templates",
        "api": {
          "queryKey": "ListIntuneTemplates-tag-autcomplete",
          "url": "/api/ListIntuneTemplates?mode=Tag",
          "labelField": "label",
          "valueField": "value"
        }
      },
      {
        "name": "AssignTo",
        "label": "Who should this template be assigned to?",
        "type": "radio",
        "options": [
          { "label": "Do not assign", "value": "On" },
          { "label": "Assign to all users", "value": "allLicensedUsers" },
          { "label": "Assign to all devices", "value": "AllDevices" },
          { "label": "Assign to all users and devices", "value": "AllDevicesAndUsers" },
          { "label": "Assign to Custom Group", "value": "customGroup" }
        ]
      },
      {
        "type": "textField",
        "required": false,
        "name": "customGroup",
        "label": "Enter the custom group name if you selected 'Assign to Custom Group'. Wildcards are allowed."
      },
      { "type": "switch", "name": "verifyAssignments", "label": "Verify policy assignments" },
      {
        "name": "excludeGroup",
        "label": "Exclude Groups",
        "type": "textField",
        "required": false,
        "helpText": "Enter the group name(s) to exclude from the assignment. Wildcards are allowed. Multiple group names are comma-seperated."
      },
      {
        "type": "textField",
        "required": false,
        "name": "assignmentFilter",
        "label": "Assignment Filter Name (Optional)",
        "helpText": "Enter the assignment filter name to apply to this policy assignment. Wildcards are allowed."
      },
      {
        "name": "assignmentFilterType",
        "label": "Assignment Filter Mode (Optional)",
        "type": "radio",
        "required": false,
        "helpText": "Choose whether to include or exclude devices matching the filter. Only applies if you specified a filter name above. Defaults to Include if not specified.",
        "options": [
          { "label": "Include - Assign to devices matching the filter", "value": "include" },
          { "label": "Exclude - Assign to devices NOT matching the filter", "value": "exclude" }
        ]
      },
      {
        "type": "number",
        "required": false,
        "name": "levenshteinDistance",
        "label": "Fuzzy Match Distance (0 = exact name match only, higher values allow replacing policies with similar names based on Levenshtein distance)",
        "defaultValue": 0,
        "validators": {
          "min": { "value": 0, "message": "Minimum value is 0" }
        },
        "warningThreshold": 5,
        "warningMessage": "Warning: values above 5 can match unrelated policies. Use with caution."
      }
    ]
  },
  {
    "name": "standards.ReusableSettingsTemplate",
    "cat": "Templates",
    "label": "Reusable Settings Template",
    "multiple": true,
    "disabledFeatures": { "report": false, "warn": false, "remediate": false },
    "impact": "High Impact",
    "impactColour": "info",
    "addedDate": "2026-01-02",
    "tag": [
      "SMB1001 (1.2)",
      "SMB1001 (1.3)",
      "SMB1001 (1.4)",
      "SMB1001 (1.8)",
      "SMB1001 (1.9)",
      "SMB1001 (1.10)",
      "SMB1001 (1.12)"
    ],
    "appliesToTest": [
      "SMB1001_1_10",
      "SMB1001_1_12",
      "SMB1001_1_2",
      "SMB1001_1_3",
      "SMB1001_1_4",
      "SMB1001_1_8",
      "SMB1001_1_9",
      "ZTNA24540",
      "ZTNA24550",
      "ZTNA24552",
      "ZTNA24574",
      "ZTNA24575",
      "ZTNA24784"
    ],
    "helpText": "Deploy and maintain Intune reusable settings templates that can be referenced by multiple policies.",
    "executiveText": "Creates and keeps reusable Intune settings templates consistent so common firewall and configuration blocks can be reused across many policies.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": false,
        "required": true,
        "name": "TemplateList",
        "label": "Select Reusable Settings Template",
        "api": {
          "queryKey": "ListIntuneReusableSettingTemplates",
          "url": "/api/ListIntuneReusableSettingTemplates",
          "labelField": "displayName",
          "valueField": "GUID",
          "showRefresh": true,
          "templateView": { "title": "Reusable Settings", "property": "RawJSON", "type": "intune" }
        }
      }
    ],
    "powershellEquivalent": "",
    "recommendedBy": []
  },
  {
    "name": "standards.TransportRuleTemplate",
    "label": "Transport Rule Template",
    "cat": "Templates",
    "disabledFeatures": { "report": true, "warn": true, "remediate": false },
    "impact": "Medium Impact",
    "addedDate": "2023-12-30",
    "helpText": "Deploy transport rules to manage email flow.",
    "executiveText": "Deploys standardized email flow rules that automatically manage how emails are processed, filtered, and routed within the organization. These templates ensure consistent email security policies, compliance requirements, and business rules are applied across all email communications.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "name": "transportRuleTemplate",
        "label": "Select Transport Rule Template",
        "api": {
          "url": "/api/ListTransportRulesTemplates?noJson=true",
          "labelField": "name",
          "valueField": "GUID",
          "queryKey": "ListTransportRulesTemplates"
        }
      },
      {
        "type": "switch",
        "label": "Overwrite existing transport rules",
        "name": "overwrite",
        "defaultValue": true
      }
    ],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.ConditionalAccessTemplate",
    "label": "Conditional Access Template",
    "cat": "Templates",
    "multiple": true,
    "disabledFeatures": { "report": true, "warn": true, "remediate": false },
    "impact": "High Impact",
    "addedDate": "2023-12-30",
    "tag": [
      "CIS M365 7.0.0 (5.2.2.1)",
      "CIS M365 7.0.0 (5.2.2.2)",
      "CIS M365 7.0.0 (5.2.2.3)",
      "CIS M365 7.0.0 (5.2.2.4)",
      "CIS M365 7.0.0 (5.2.2.5)",
      "CIS M365 7.0.0 (5.2.2.6)",
      "CIS M365 7.0.0 (5.2.2.7)",
      "CIS M365 7.0.0 (5.2.2.8)",
      "CIS M365 7.0.0 (5.2.2.9)",
      "CIS M365 7.0.0 (5.2.2.10)",
      "CIS M365 7.0.0 (5.2.2.11)",
      "CIS M365 7.0.0 (5.2.2.12)",
      "SMB1001 (2.5)",
      "SMB1001 (2.6)",
      "SMB1001 (2.8)",
      "SMB1001 (2.9)"
    ],
    "appliesToTest": [
      "CIS_5_2_2_1",
      "CIS_5_2_2_10",
      "CIS_5_2_2_11",
      "CIS_5_2_2_12",
      "CIS_5_2_2_2",
      "CIS_5_2_2_3",
      "CIS_5_2_2_4",
      "CIS_5_2_2_5",
      "CIS_5_2_2_6",
      "CIS_5_2_2_7",
      "CIS_5_2_2_8",
      "CIS_5_2_2_9",
      "SMB1001_2_5",
      "SMB1001_2_6",
      "SMB1001_2_8",
      "SMB1001_2_9",
      "ZTNA21783",
      "ZTNA21786",
      "ZTNA21806",
      "ZTNA21808",
      "ZTNA21824",
      "ZTNA21825",
      "ZTNA21828",
      "ZTNA21830",
      "ZTNA21883",
      "ZTNA21892",
      "ZTNA21941",
      "ZTNA24827"
    ],
    "helpText": "Manage conditional access policies for better security.",
    "executiveText": "Deploys standardized conditional access policies that automatically enforce security requirements based on user location, device compliance, and risk factors. These templates ensure consistent security controls across the organization while enabling secure access to business resources.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "name": "TemplateList",
        "multiple": false,
        "required": false,
        "creatable": false,
        "label": "Select Conditional Access Template",
        "api": {
          "url": "/api/ListCATemplates",
          "labelField": "displayName",
          "valueField": "GUID",
          "queryKey": "ListCATemplates",
          "showRefresh": true,
          "templateView": { "title": "Conditional Access Policy" }
        }
      },
      {
        "type": "autoComplete",
        "multiple": false,
        "required": false,
        "creatable": false,
        "name": "TemplateList-Tags",
        "label": "Or select a package of CA Templates",
        "api": {
          "queryKey": "ListCATemplates-tag-autocomplete",
          "url": "/api/ListCATemplates?mode=Tag",
          "labelField": "label",
          "valueField": "value",
          "addedField": {
            "templates": "templates"
          }
        }
      },
      {
        "name": "state",
        "label": "What state should we deploy this template in?",
        "type": "radio",
        "options": [
          { "value": "donotchange", "label": "Do not change state" },
          { "value": "Enabled", "label": "Set to enabled" },
          { "value": "Disabled", "label": "Set to disabled" },
          { "value": "enabledForReportingButNotEnforced", "label": "Set to report only" }
        ]
      },
      {
        "type": "switch",
        "name": "DisableSD",
        "label": "Disable Security Defaults when deploying policy"
      },
      { "type": "switch", "name": "CreateGroups", "label": "Create groups if they do not exist" }
    ],
    "requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2"]
  },
  {
    "name": "standards.ExchangeConnectorTemplate",
    "label": "Exchange Connector Template",
    "cat": "Templates",
    "disabledFeatures": { "report": true, "warn": true, "remediate": false },
    "impact": "Medium Impact",
    "addedDate": "2023-12-30",
    "helpText": "Deploy and manage Exchange connectors.",
    "executiveText": "Configures standardized Exchange connectors that control how email flows between your organization and external systems. These templates ensure secure and reliable email delivery while maintaining proper routing and security policies for business communications.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "name": "exConnectorTemplate",
        "label": "Select Exchange Connector Template",
        "api": {
          "url": "/api/ListExConnectorTemplates",
          "labelField": "name",
          "valueField": "GUID",
          "queryKey": "ListExConnectorTemplates"
        }
      }
    ],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.GroupTemplate",
    "label": "Group Template",
    "multi": true,
    "cat": "Templates",
    "tag": [],
    "appliesToTest": [],
    "disabledFeatures": { "report": true, "warn": true, "remediate": false },
    "impact": "Medium Impact",
    "addedDate": "2023-12-30",
    "helpText": "Deploy and manage group templates.",
    "executiveText": "Creates standardized groups with predefined settings, permissions, and membership rules. These templates ensure consistent group configurations across the organization, streamlining collaboration and access management while maintaining security standards.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "name": "groupTemplate",
        "label": "Select Group Template",
        "api": {
          "url": "/api/ListGroupTemplates",
          "labelField": "Displayname",
          "altLabelField": "displayName",
          "valueField": "GUID",
          "queryKey": "ListGroupTemplates"
        }
      }
    ],
    "requiredCapabilities": ["EXCHANGE_S_STANDARD", "EXCHANGE_S_ENTERPRISE", "EXCHANGE_LITE"]
  },
  {
    "name": "standards.DlpCompliancePolicyTemplate",
    "label": "DLP Compliance Policy Template",
    "multi": true,
    "cat": "Templates",
    "disabledFeatures": { "report": false, "warn": false, "remediate": false },
    "impact": "Medium Impact",
    "addedDate": "2026-05-10",
    "helpText": "Deploy Microsoft Purview DLP compliance policies from CIPP templates.",
    "executiveText": "Deploys Data Loss Prevention policies from a standardized template library. Ensures consistent DLP coverage across tenants for sensitive data such as financial, identity, and regulated content.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": false,
        "name": "dlpCompliancePolicyTemplate",
        "label": "Select DLP Compliance Policy Templates",
        "api": {
          "url": "/api/ListDlpCompliancePolicyTemplates",
          "labelField": "name",
          "valueField": "GUID",
          "queryKey": "ListDlpCompliancePolicyTemplates"
        }
      }
    ]
  },
  {
    "name": "standards.RetentionCompliancePolicyTemplate",
    "label": "Retention Compliance Policy Template",
    "multi": true,
    "cat": "Templates",
    "disabledFeatures": { "report": false, "warn": false, "remediate": false },
    "impact": "Medium Impact",
    "addedDate": "2026-05-10",
    "helpText": "Deploy Microsoft Purview retention compliance policies from CIPP templates.",
    "executiveText": "Deploys retention policies that govern how long content is preserved in Exchange, SharePoint, OneDrive, and Teams. Enforces consistent compliance retention across tenants for regulatory and legal hold needs.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": false,
        "name": "retentionCompliancePolicyTemplate",
        "label": "Select Retention Compliance Policy Templates",
        "api": {
          "url": "/api/ListRetentionCompliancePolicyTemplates",
          "labelField": "name",
          "valueField": "GUID",
          "queryKey": "ListRetentionCompliancePolicyTemplates"
        }
      }
    ]
  },
  {
    "name": "standards.SensitivityLabelTemplate",
    "label": "Sensitivity Label Template",
    "multi": true,
    "cat": "Templates",
    "disabledFeatures": { "report": false, "warn": false, "remediate": false },
    "impact": "Medium Impact",
    "addedDate": "2026-05-10",
    "helpText": "Deploy Microsoft Purview sensitivity labels from CIPP templates.",
    "executiveText": "Deploys sensitivity labels for classification and protection of files, emails, and Microsoft 365 group content. Ensures consistent classification taxonomy and encryption settings across tenants.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": false,
        "name": "sensitivityLabelTemplate",
        "label": "Select Sensitivity Label Templates",
        "api": {
          "url": "/api/ListSensitivityLabelTemplates",
          "labelField": "name",
          "valueField": "GUID",
          "queryKey": "ListSensitivityLabelTemplates"
        }
      }
    ]
  },
  {
    "name": "standards.SensitiveInfoTypeTemplate",
    "label": "Sensitive Information Type Template",
    "multi": true,
    "cat": "Templates",
    "disabledFeatures": { "report": false, "warn": false, "remediate": false },
    "impact": "Low Impact",
    "addedDate": "2026-05-10",
    "helpText": "Deploy custom Microsoft Purview Sensitive Information Types from CIPP templates.",
    "executiveText": "Deploys custom Sensitive Information Types so DLP policies can detect organization-specific identifiers — employee IDs, project codenames, internal account numbers — across tenants consistently.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": false,
        "name": "sensitiveInfoTypeTemplate",
        "label": "Select Sensitive Information Type Templates",
        "api": {
          "url": "/api/ListSensitiveInfoTypeTemplates",
          "labelField": "name",
          "valueField": "GUID",
          "queryKey": "ListSensitiveInfoTypeTemplates"
        }
      }
    ]
  },
  {
    "name": "standards.AssignmentFilterTemplate",
    "label": "Assignment Filter Template",
    "multi": true,
    "cat": "Templates",
    "disabledFeatures": { "report": true, "warn": true, "remediate": false },
    "impact": "Medium Impact",
    "addedDate": "2025-10-04",
    "helpText": "Deploy and manage assignment filter templates.",
    "executiveText": "Creates standardized assignment filters with predefined settings. These templates ensure consistent assignment filter configurations across the organization, streamlining assignment management.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "name": "assignmentFilterTemplate",
        "label": "Select Assignment Filter Template",
        "api": {
          "url": "/api/ListAssignmentFilterTemplates",
          "labelField": "Displayname",
          "altLabelField": "displayName",
          "valueField": "GUID",
          "queryKey": "ListAssignmentFilterTemplates"
        }
      }
    ],
    "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"]
  },
  {
    "name": "standards.TenantAllowBlockListTemplate",
    "label": "Tenant Allow/Block List Template",
    "cat": "Exchange Standards",
    "disabledFeatures": { "report": false, "warn": false, "remediate": false },
    "impact": "Medium Impact",
    "addedDate": "2026-04-02",
    "helpText": "Deploy tenant allow/block list entries from a saved template.",
    "executiveText": "Deploys standardized tenant allow/block list entries across tenants. These templates ensure consistent email filtering rules are applied, managing which senders, URLs, file hashes, and IP addresses are allowed or blocked across the organization.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "name": "TenantAllowBlockListTemplate",
        "required": false,
        "multiple": true,
        "label": "Select Tenant Allow/Block List Template",
        "api": {
          "url": "/api/ListTenantAllowBlockListTemplates",
          "labelField": "templateName",
          "valueField": "GUID",
          "queryKey": "ListTenantAllowBlockListTemplates",
          "showRefresh": true
        }
      }
    ],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.MailboxRecipientLimits",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Sets the maximum number of recipients that can be specified in the To, Cc, and Bcc fields of a message for all mailboxes in the tenant.",
    "docsDescription": "This standard configures the recipient limits for all mailboxes in the tenant. The recipient limit determines the maximum number of recipients that can be specified in the To, Cc, and Bcc fields of a message. This helps prevent spam and manage email flow.",
    "executiveText": "Controls how many recipients employees can include in a single email, helping prevent spam distribution and managing email server load. This security measure protects against both accidental mass mailings and potential abuse while ensuring legitimate business communications can still reach necessary recipients.",
    "addedComponent": [
      {
        "type": "number",
        "name": "standards.MailboxRecipientLimits.RecipientLimit",
        "label": "Recipient Limit",
        "defaultValue": 500,
        "validators": {
          "min": { "value": 1, "message": "Minimum value is 1" },
          "max": { "value": 1000, "message": "Maximum value is 1000" }
        }
      }
    ],
    "label": "Set Mailbox Recipient Limits",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-05-28",
    "powershellEquivalent": "Set-Mailbox -RecipientLimits",
    "recommendedBy": ["CIPP"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.DisableExchangeOnlinePowerShell",
    "cat": "Exchange Standards",
    "tag": ["Security", "NIST CSF 2.0 (PR.AA-05)"],
    "helpText": "Disables Exchange Online PowerShell access for non-admin users by setting the RemotePowerShellEnabled property to false for each user. This helps prevent attackers from using PowerShell to run malicious commands, access file systems, registry, and distribute ransomware throughout networks. Users with admin roles are automatically excluded.",
    "docsDescription": "Disables Exchange Online PowerShell access for non-admin users by setting the RemotePowerShellEnabled property to false for each user. This security measure follows a least privileged access approach, preventing potential attackers from using PowerShell to execute malicious commands, access sensitive systems, or distribute malware. Users with management roles containing 'Admin' are automatically excluded to ensure administrators retain PowerShell access to perform necessary management tasks.",
    "executiveText": "Restricts PowerShell access to Exchange Online for regular employees while maintaining access for administrators, significantly reducing security risks from compromised accounts. This prevents attackers from using PowerShell to execute malicious commands or distribute ransomware while preserving necessary administrative capabilities.",
    "label": "Disable Exchange Online PowerShell for non-admin users",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2025-06-19",
    "powershellEquivalent": "Set-User -Identity $user -RemotePowerShellEnabled $false",
    "recommendedBy": ["CIS", "CIPP"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.OWAAttachmentRestrictions",
    "cat": "Exchange Standards",
    "tag": ["Security", "NIST CSF 2.0 (PR.AA-05)"],
    "helpText": "Restricts how users on unmanaged devices can interact with email attachments in Outlook on the web and new Outlook for Windows. Prevents downloading attachments or blocks viewing them entirely.",
    "docsDescription": "This standard configures the OWA mailbox policy to restrict access to email attachments on unmanaged devices. Users can be prevented from downloading attachments (but can view/edit via Office Online) or blocked from seeing attachments entirely. This helps prevent data exfiltration through email attachments on devices not managed by the organization.",
    "executiveText": "Restricts access to email attachments on personal or unmanaged devices while allowing full functionality on corporate-managed devices. This security measure prevents data theft through email attachments while maintaining productivity for employees using approved company devices.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "name": "standards.OWAAttachmentRestrictions.ConditionalAccessPolicy",
        "label": "Attachment Restriction Policy",
        "options": [
          { "label": "Read Only (View/Edit via Office Online, no download)", "value": "ReadOnly" },
          {
            "label": "Read Only Plus Attachments Blocked (Cannot see attachments)",
            "value": "ReadOnlyPlusAttachmentsBlocked"
          }
        ],
        "defaultValue": "ReadOnlyPlusAttachmentsBlocked"
      }
    ],
    "label": "Restrict Email Attachments on Unmanaged Devices",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2025-08-22",
    "powershellEquivalent": "Set-OwaMailboxPolicy -Identity \"OwaMailboxPolicy-Default\" -ConditionalAccessPolicy ReadOnlyPlusAttachmentsBlocked",
    "recommendedBy": ["Microsoft Zero Trust", "CIPP"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.LegacyEmailReportAddins",
    "deprecated": false,
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Removes legacy Report Phishing and Report Message Outlook add-ins.",
    "executiveText": "The legacy Report Phishing and Report Message Outlook add-ins are security issues with the add-in which makes them unsafe for the organization.",
    "label": "Remove legacy Outlook Report add-ins",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-08-26",
    "powershellEquivalent": "None",
    "recommendedBy": ["Microsoft"]
  },
  {
    "name": "standards.DeployCheckChromeExtension",
    "cat": "Intune Standards",
    "tag": [],
    "helpText": "Deploys the Check by CyberDrain browser extension via a Win32 script app in Intune for both Chrome and Edge browsers with configurable settings. Chrome ID: benimdeioplgkhanklclahllklceahbe, Edge ID: knepjpocdagponkonnbggpcnhnaikajg",
    "docsDescription": "Creates an Intune Win32 script application that writes registry keys to install and configure the Check by CyberDrain browser extension on managed devices for both Google Chrome and Microsoft Edge browsers. Uses a PowerShell detection script to enforce configuration drift — when settings change in CIPP the app is automatically redeployed.",
    "executiveText": "Automatically deploys the Check by CyberDrain browser extension across all company devices with configurable security and branding settings, ensuring consistent security monitoring and compliance capabilities. This extension provides enhanced security features and monitoring tools that help protect against threats while maintaining user productivity.",
    "addedComponent": [
      {
        "type": "switch",
        "name": "standards.DeployCheckChromeExtension.showNotifications",
        "label": "Show notifications",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.DeployCheckChromeExtension.enableValidPageBadge",
        "label": "Enable valid page badge",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.DeployCheckChromeExtension.enablePageBlocking",
        "label": "Enable page blocking",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.DeployCheckChromeExtension.forceToolbarPin",
        "label": "Force pin extension to toolbar",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.DeployCheckChromeExtension.enableCippReporting",
        "label": "Enable CIPP reporting",
        "defaultValue": true
      },
      {
        "type": "textField",
        "name": "standards.DeployCheckChromeExtension.customRulesUrl",
        "label": "Custom Rules URL",
        "placeholder": "https://YOUR-CIPP-SERVER-URL/rules.json",
        "helperText": "Enter the URL for custom rules if you have them. This should point to a JSON file with the same structure as the rules.json used for CIPP reporting.",
        "required": false
      },
      {
        "type": "number",
        "name": "standards.DeployCheckChromeExtension.updateInterval",
        "label": "Update interval (hours)",
        "defaultValue": 24
      },
      {
        "type": "switch",
        "name": "standards.DeployCheckChromeExtension.enableDebugLogging",
        "label": "Enable debug logging",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.DeployCheckChromeExtension.enableGenericWebhook",
        "label": "Enable generic webhook",
        "defaultValue": false
      },
      {
        "type": "textField",
        "name": "standards.DeployCheckChromeExtension.webhookUrl",
        "label": "Webhook URL",
        "placeholder": "https://webhook.example.com/endpoint",
        "required": false
      },
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": true,
        "required": false,
        "name": "standards.DeployCheckChromeExtension.webhookEvents",
        "label": "Webhook Events",
        "placeholder": "e.g. pageBlocked, pageAllowed"
      },
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": true,
        "required": false,
        "freeSolo": true,
        "name": "standards.DeployCheckChromeExtension.urlAllowlist",
        "label": "URL Allowlist",
        "placeholder": "e.g. https://example.com/*",
        "helperText": "Enter URLs to allowlist in the extension. Press enter to add each URL. Wildcards are allowed. This should be used for sites that are being blocked by the extension but are known to be safe."
      },
      {
        "type": "switch",
        "name": "standards.DeployCheckChromeExtension.domainSquattingEnabled",
        "label": "Enable domain squatting detection",
        "defaultValue": true
      },
      {
        "type": "textField",
        "name": "standards.DeployCheckChromeExtension.companyName",
        "label": "Company Name",
        "placeholder": "YOUR-COMPANY",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.DeployCheckChromeExtension.productName",
        "label": "Product Name",
        "placeholder": "YOUR-PRODUCT-NAME",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.DeployCheckChromeExtension.supportEmail",
        "label": "Support Email",
        "placeholder": "support@yourcompany.com",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.DeployCheckChromeExtension.supportUrl",
        "label": "Support URL",
        "placeholder": "https://support.yourcompany.com",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.DeployCheckChromeExtension.privacyPolicyUrl",
        "label": "Privacy Policy URL",
        "placeholder": "https://yourcompany.com/privacy",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.DeployCheckChromeExtension.aboutUrl",
        "label": "About URL",
        "placeholder": "https://yourcompany.com/about",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.DeployCheckChromeExtension.primaryColor",
        "label": "Primary Color",
        "placeholder": "#F77F00",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.DeployCheckChromeExtension.logoUrl",
        "label": "Logo URL",
        "placeholder": "https://yourcompany.com/logo.png",
        "required": false
      },
      {
        "name": "AssignTo",
        "label": "Who should this app be assigned to?",
        "type": "radio",
        "options": [
          { "label": "Do not assign", "value": "On" },
          { "label": "Assign to all users", "value": "allLicensedUsers" },
          { "label": "Assign to all devices", "value": "AllDevices" },
          { "label": "Assign to all users and devices", "value": "AllDevicesAndUsers" },
          { "label": "Assign to Custom Group", "value": "customGroup" }
        ]
      },
      {
        "type": "textField",
        "required": false,
        "name": "customGroup",
        "label": "Enter the custom group name if you selected 'Assign to Custom Group'. Wildcards are allowed."
      }
    ],
    "label": "Deploy Check by CyberDrain Browser Extension",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-09-18",
    "powershellEquivalent": "Add-CIPPW32ScriptApplication",
    "recommendedBy": ["CIPP"],
    "requiredCapabilities": ["INTUNE_A", "MDM_Services", "EMS", "SCCM", "MICROSOFTINTUNEPLAN1"]
  },
  {
    "name": "standards.SecureScoreRemediation",
    "cat": "Global Standards",
    "tag": ["lowimpact"],
    "helpText": "Allows bulk updating of Secure Score control profiles across tenants. Select controls and assign them to different states: Default, Ignored, Third-Party, or Reviewed.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": true,
        "required": false,
        "name": "standards.SecureScoreRemediation.Default",
        "label": "Controls to set to Default",
        "api": { "url": "/secureScore.json", "labelField": "title", "valueField": "id" }
      },
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": true,
        "required": false,
        "name": "standards.SecureScoreRemediation.Ignored",
        "label": "Controls to set to Ignored",
        "api": { "url": "/secureScore.json", "labelField": "title", "valueField": "id" }
      },
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": true,
        "required": false,
        "name": "standards.SecureScoreRemediation.ThirdParty",
        "label": "Controls to set to Third-Party",
        "api": { "url": "/secureScore.json", "labelField": "title", "valueField": "id" }
      },
      {
        "type": "autoComplete",
        "multiple": true,
        "required": false,
        "creatable": true,
        "name": "standards.SecureScoreRemediation.Reviewed",
        "label": "Controls to set to Reviewed",
        "api": { "url": "/secureScore.json", "labelField": "title", "valueField": "id" }
      }
    ],
    "label": "Update Secure Score Control Profiles",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2025-11-19",
    "powershellEquivalent": "New-GraphPostRequest to /beta/security/secureScoreControlProfiles/{id}"
  },
  {
    "name": "standards.ColleagueImpersonationAlert",
    "cat": "Exchange Standards",
    "tag": ["Exchange", "Security", "Transport Rules"],
    "helpText": "Creates/updates 5x Exchange Online transport rules (A-E, F-J, K-O, P-T, U-Z) that prepend an HTML disclaimer banner to inbound emails where the sender display name matches a mailbox in the organisation. Accepted tenant domains are always exempt automatically. Inactive users are removed and enabled users are added. Any manually configured sender or domain exemptions already present on existing rules are preserved.",
    "docsDescription": "Creates five Exchange Online transport rules grouped by the first letter of user display names (A-E, F-J, K-O, P-T, U-Z). Each rule fires when an external sender's From header matches a display name in that group, prepends a configurable HTML warning banner, and skips emails from accepted organisational domains. Any manually configured sender or domain exemptions on existing rules are preserved when the standard runs. The disclaimer HTML is fully customisable via the standard settings.",
    "executiveText": "Protects staff from display-name impersonation attacks by injecting a visible warning banner on emails that appear to come from a colleague but originate externally. Rules are maintained automatically across all letter groups and updated whenever the standard runs.",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.ColleagueImpersonationAlert.disclaimerHtml",
        "label": "Disclaimer HTML – Paste the full HTML for the warning banner",
        "required": true
      },
      {
        "type": "autoComplete",
        "name": "standards.ColleagueImpersonationAlert.excludedMailboxes",
        "label": "Exclude mailboxes by keywords for example any Displayname starting with (Leaver)",
        "multiple": true,
        "creatable": true,
        "required": false
      },
      {
        "type": "autoComplete",
        "name": "standards.ColleagueImpersonationAlert.additionalExemptSenders",
        "label": "Additional exempt sender addresses",
        "multiple": true,
        "creatable": true,
        "required": false
      }
    ],
    "label": "Colleague Impersonation Alert Transport Rules",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2026-03-22",
    "powershellEquivalent": "New-TransportRule / Set-TransportRule",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.DefenderCompliancePolicy",
    "cat": "Defender Standards",
    "tag": ["defender_mde_connector", "defender_intune_compliance"],
    "helpText": "Configures the Microsoft Defender for Endpoint connector with Intune, enabling compliance evaluation for mobile and desktop platforms (Android, iOS, macOS, Windows). Controls which platforms connect to MDE and whether devices are blocked when partner data is missing.",
    "docsDescription": "Configures the Microsoft Defender for Endpoint mobile threat defense connector with Intune. This enables compliance evaluation across platforms (Android, iOS/iPadOS, macOS, Windows) and controls settings like blocking unsupported OS versions, requiring partner data for compliance, and enabling mobile application management. The connector must be enabled before platform-specific compliance policies can evaluate device risk from MDE.",
    "executiveText": "Establishes the critical link between Microsoft Defender for Endpoint and Intune, enabling security risk data from MDE to be used in device compliance policies. This ensures that only devices meeting your organization's security standards can access corporate resources, providing a foundational layer of Zero Trust security across all platforms.",
    "addedComponent": [
      {
        "type": "switch",
        "name": "standards.DefenderCompliancePolicy.ConnectAndroid",
        "label": "Connect Android devices to MDE",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.DefenderCompliancePolicy.ConnectAndroidCompliance",
        "label": "Connect Android 6.0.0+ (App-based MAM)",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.DefenderCompliancePolicy.androidDeviceBlockedOnMissingPartnerData",
        "label": "Block Android if partner data unavailable",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.DefenderCompliancePolicy.ConnectIos",
        "label": "Connect iOS/iPadOS devices to MDE",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.DefenderCompliancePolicy.ConnectIosCompliance",
        "label": "Connect iOS 13.0+ (App-based MAM)",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.DefenderCompliancePolicy.appSync",
        "label": "Enable App Sync for iOS",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.DefenderCompliancePolicy.iosDeviceBlockedOnMissingPartnerData",
        "label": "Block iOS if partner data unavailable",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.DefenderCompliancePolicy.allowPartnerToCollectIosCertificateMetadata",
        "label": "Collect certificate metadata from iOS",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.DefenderCompliancePolicy.allowPartnerToCollectIosPersonalCertificateMetadata",
        "label": "Collect personal certificate metadata from iOS",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.DefenderCompliancePolicy.ConnectMac",
        "label": "Connect macOS devices to MDE",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.DefenderCompliancePolicy.macDeviceBlockedOnMissingPartnerData",
        "label": "Block macOS if partner data unavailable",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.DefenderCompliancePolicy.ConnectWindows",
        "label": "Connect Windows 10.0.15063+ to MDE (Note: enabling this forces 'Block Windows if partner data unavailable' to on)",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.DefenderCompliancePolicy.windowsMobileApplicationManagementEnabled",
        "label": "Connect Windows (MAM)",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.DefenderCompliancePolicy.windowsDeviceBlockedOnMissingPartnerData",
        "label": "Block Windows if partner data unavailable (Note: Microsoft enforces this to on when Connect Windows 10.0.15063+ to MDE is on)",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.DefenderCompliancePolicy.BlockunsupportedOS",
        "label": "Block unsupported OS versions",
        "defaultValue": false
      },
      {
        "type": "switch",
        "name": "standards.DefenderCompliancePolicy.AllowMEMEnforceCompliance",
        "label": "Allow MEM enforcement of compliance",
        "defaultValue": false
      }
    ],
    "label": "Defender for Endpoint - Intune Compliance Connector",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2026-04-02",
    "powershellEquivalent": "Graph API - deviceManagement/mobileThreatDefenseConnectors",
    "recommendedBy": []
  },
  {
    "name": "standards.GlobalQuarantineSettings",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Configures the Global Quarantine Policy settings including sender name, custom subject, disclaimer, from address, and org branding.",
    "docsDescription": "Configures the Global Quarantine Policy branding and notification settings for the tenant. This includes the quarantine notification sender display name, custom subject line, disclaimer text, the from address used for notifications, and whether to use org branding. Notification frequency is managed separately by the GlobalQuarantineNotifications standard.",
    "executiveText": "Ensures quarantine notification emails are branded and configured consistently, so end users receive clear, professional alerts about quarantined messages and know how to request release.",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.GlobalQuarantineSettings.SenderName",
        "label": "Sender Display Name (e.g. Contoso-Office365Alerts)",
        "helperText": "Will be overridden if an active sender address with an existing display name is used.",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.GlobalQuarantineSettings.CustomSubject",
        "label": "Subject",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.GlobalQuarantineSettings.CustomDisclaimer",
        "label": "Disclaimer (max 200 characters)",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.GlobalQuarantineSettings.FromAddress",
        "label": "Specify Sender Address (must be an internal mailbox)",
        "required": false
      },
      {
        "type": "switch",
        "name": "standards.GlobalQuarantineSettings.OrganizationBrandingEnabled",
        "label": "Use Organization Branding (logo)",
        "helperText": "Requires branding to be configured in the Microsoft 365 admin centre."
      }
    ],
    "label": "Configure Global Quarantine Notification Settings",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2026-04-02",
    "powershellEquivalent": "Set-QuarantinePolicy (GlobalQuarantinePolicy)",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.SPDisableCustomScripts",
    "cat": "SharePoint Standards",
    "tag": [],
    "helpText": "Prevents users from running custom scripts on SharePoint and OneDrive sites. Custom scripts can modify site behaviors and bypass governance controls.",
    "docsDescription": "Disables the ability to add and run custom scripts on SharePoint and OneDrive sites at the tenant level. When custom scripts are allowed, governance cannot be enforced, and the capabilities of inserted code cannot be scoped or blocked. Microsoft recommends using the SharePoint Framework instead of custom scripts.",
    "executiveText": "Blocks custom scripts from being added to SharePoint and OneDrive sites, enforcing governance controls and preventing unscoped code execution. This aligns with Microsoft's Baseline Security Mode recommendation to permanently remove the ability to add new custom scripts, directing organizations to use the SharePoint Framework instead.",
    "addedComponent": [],
    "label": "Disable custom scripts on SharePoint sites",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2026-04-28",
    "powershellEquivalent": "Set-SPOTenant -CustomScriptsRestrictMode $true",
    "recommendedBy": ["CIPP"],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.SPDisableStoreAccess",
    "cat": "SharePoint Standards",
    "tag": [],
    "helpText": "Disables end users from installing applications from the Microsoft Store into SharePoint sites.",
    "docsDescription": "Removes the ability for end users to install applications directly from the Microsoft Store into SharePoint. This prevents uncontrolled app installations that can increase governance costs and go against organizational policies.",
    "executiveText": "Prevents end users from installing applications from the Microsoft Store into SharePoint sites, ensuring that only approved applications are available. This reduces governance overhead and aligns with Microsoft's Baseline Security Mode recommendations.",
    "addedComponent": [],
    "label": "Disable SharePoint Store access",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2026-04-28",
    "powershellEquivalent": "Set-SPOTenant -DisableSharePointStoreAccess $true",
    "recommendedBy": ["CIPP"],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.DisableEWS",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Disables Exchange Web Services (EWS) organization-wide. This reduces the attack surface by blocking legacy API access to mailbox data. Warning: This may break Office web add-ins on builds older than 16.0.19127.",
    "docsDescription": "Disables Exchange Web Services (EWS) at the organization level to reduce attack surface. EWS provides cross-platform API access to sensitive Exchange Online data such as emails, meetings, and contacts. If compromised, attackers can access confidential data, send phishing emails, or spoof identities. Disabling EWS also reduces legacy app usage and minimizes exploitable endpoints. Note that this may break first-party features including web add-ins for Word, Excel, PowerPoint, and Outlook on builds older than 16.0.19127.",
    "executiveText": "Disables Exchange Web Services (EWS) across the organization to reduce attack surface and prevent legacy API access to sensitive mailbox data. This aligns with Microsoft's Baseline Security Mode recommendation to minimize exploitable endpoints while requiring updates to applications that depend on EWS.",
    "addedComponent": [],
    "label": "Disable Exchange Web Services",
    "impact": "High Impact",
    "impactColour": "danger",
    "addedDate": "2026-04-28",
    "powershellEquivalent": "Set-OrganizationConfig -EwsEnabled $false",
    "recommendedBy": ["CIPP"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.OMEBranding",
    "cat": "Exchange Standards",
    "tag": [],
    "helpText": "Configures the branding applied to Microsoft Purview (OME) encrypted emails, including the logo, background color, and the text recipients see when viewing a protected message. [Read more](https://learn.microsoft.com/en-us/purview/add-your-organization-brand-to-encrypted-messages)",
    "docsDescription": "Configures Office Message Encryption (OME) branding settings for the tenant default configuration. Allows organizations to apply a custom logo (via URL), background color, button text, and portal text to encrypted emails viewed by external recipients.",
    "executiveText": "Applies organizational branding to encrypted emails so recipients see a professional, on-brand experience when viewing protected messages. Reinforces brand identity while preserving security compliance.",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.OMEBranding.BackgroundColor",
        "label": "Background Color - Optional",
        "placeholder": "#ffffff",
        "helpText": "The background color of the encrypted message wrapper. Enter an HTML hex color code (e.g. #ffffff) or a named color value (e.g. white).",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.OMEBranding.LogoUrl",
        "label": "Logo Image URL - Optional (Less than 40kb 170x70 pixels)",
        "placeholder": "https://example.com/logo.png or %CustomVarable%",
        "helpText": "URL to your organization's logo displayed in the encrypted email and the reading portal. Supported formats: PNG, JPG, BMP, TIFF. Optimal size: 170x70 px, max 40 KB.",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.OMEBranding.IntroductionText",
        "label": "Text next to the sender's name and email address - Optional",
        "placeholder": "has sent you a secure message.",
        "helpText": "Text that appears next to the sender's name and email address. Maximum 1024 characters.",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.OMEBranding.ReadButtonText",
        "label": "Read Button Text - Optional",
        "placeholder": "Read Secure Message.",
        "helpText": "Text that appears on the 'Read Message' button. Maximum 1024 characters.",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.OMEBranding.EmailText",
        "label": "Email Text below the button - Optional",
        "placeholder": "Encrypted message from Contoso secure messaging system.",
        "helpText": "Text that appears below the 'Read Message' button. Maximum 1024 characters.",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.OMEBranding.PrivacyStatementUrl",
        "label": "Privacy Statement URL - Optional",
        "placeholder": "https://contoso.com/privacystatement.html",
        "helpText": "URL for the Privacy Statement link in the encrypted email notification. Leave blank to use Microsoft's default privacy statement.",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.OMEBranding.DisclaimerText",
        "label": "Disclaimer Statement  - Optional",
        "placeholder": "This message is confidential for the use of the addressee only.",
        "helpText": "Disclaimer statement shown in the email that contains the encrypted message. Maximum 1024 characters.",
        "required": false
      },
      {
        "type": "textField",
        "name": "standards.OMEBranding.PortalText",
        "label": "Text appears at the top of the encrypted mail viewing portal  - Optional",
        "placeholder": "Contoso secure email portal.",
        "helpText": "Text that appears at the top of the encrypted mail viewing portal. Maximum 128 characters.",
        "required": false
      },
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "name": "standards.OMEBranding.OTPEnabled",
        "label": "One-Time Pass Code - Required",
        "helpText": "Enable or disable authentication with a one-time pass code. When enabled, recipients without a Microsoft account can verify their identity via a code sent to their email.",
        "options": [
          {
            "label": "Enabled",
            "value": true
          },
          {
            "label": "Disabled",
            "value": false
          }
        ]
      },
      {
        "type": "autoComplete",
        "multiple": false,
        "creatable": false,
        "name": "standards.OMEBranding.SocialIdSignIn",
        "label": "Social ID Sign-In - Required",
        "helpText": "Enable or disable authentication with Microsoft, Google, or Yahoo identities. When enabled, recipients can sign in with an existing social account to view the encrypted message.",
        "options": [
          {
            "label": "Enabled",
            "value": true
          },
          {
            "label": "Disabled",
            "value": false
          }
        ]
      }
    ],
    "label": "Configure Encrypted Message Branding (OME)",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2026-04-25",
    "powershellEquivalent": "Set-OMEConfiguration",
    "recommendedBy": [],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.EnforcePrivateGroups",
    "cat": "Entra (AAD) Standards",
    "tag": ["CIS M365 7.0.0 (1.2.1)"],
    "appliesToTest": ["CIS_1_2_1"],
    "helpText": "Sets all public Microsoft 365 groups to private automatically. Groups can be excluded by display name keyword.",
    "docsDescription": "Ensures only organisation-managed or approved public groups exist by automatically switching public Microsoft 365 (Unified) groups to private visibility. Groups whose display name matches any of the configured exclusion keywords are left unchanged. This aligns with CIS M365 7.0.0 benchmark control 1.2.1.",
    "executiveText": "Enforces private visibility on all Microsoft 365 groups to prevent unauthorised external access to group resources such as Teams, SharePoint sites, and Planner boards. Approved public groups can be excluded by name, ensuring governance while retaining flexibility for intentionally public collaboration spaces.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": true,
        "required": false,
        "label": "Exclude groups by display name keyword",
        "name": "standards.EnforcePrivateGroups.ExcludedGroupNames"
      }
    ],
    "label": "Enforce Private M365 Groups",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2026-05-06",
    "powershellEquivalent": "Update-MgGroup -GroupId <id> -Visibility Private",
    "recommendedBy": ["CIS"],
    "requiredCapabilities": [
      "SHAREPOINTWAC",
      "SHAREPOINTSTANDARD",
      "SHAREPOINTENTERPRISE",
      "SHAREPOINTENTERPRISE_EDU",
      "SHAREPOINTENTERPRISE_GOV",
      "ONEDRIVE_BASIC",
      "ONEDRIVE_ENTERPRISE"
    ]
  },
  {
    "name": "standards.EmptyFilterIPAllowList",
    "cat": "Defender Standards",
    "tag": ["CIS M365 7.0.0 (2.1.12)"],
    "appliesToTest": ["CIS_2_1_12"],
    "helpText": "Ensures the connection filter IP allow list is not used. IPs on this list bypass spam, spoof, and authentication checks.",
    "docsDescription": "IPs on the connection filter allow list bypass spam, spoof, and authentication checks. CIS recommends keeping this list empty to ensure all inbound email is properly scanned. This standard checks that the IPAllowList on the Default hosted connection filter policy is empty and can remediate by clearing it.",
    "executiveText": "Ensures the Exchange Online connection filter IP allow list is empty, preventing any IP addresses from bypassing spam filtering, spoofing checks, and sender authentication. Keeping this list empty ensures all inbound email undergoes full security scanning, reducing the risk of phishing and malware delivery through trusted-but-compromised sources.",
    "addedComponent": [],
    "label": "Ensure connection filter IP allow list is empty",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2026-05-06",
    "powershellEquivalent": "Set-HostedConnectionFilterPolicy -Identity Default -IPAllowList @()",
    "recommendedBy": ["CIS"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.TeamsZAP",
    "cat": "Defender Standards",
    "tag": ["CIS M365 7.0.0 (2.4.4)"],
    "appliesToTest": ["CIS_2_4_4"],
    "helpText": "Ensures Zero-hour auto purge (ZAP) is enabled for Microsoft Teams, automatically removing malicious messages after delivery.",
    "docsDescription": "Zero-hour auto purge (ZAP) for Microsoft Teams retroactively detects and neutralises malicious messages that have already been delivered in Teams chats. Enabling ZAP ensures that phishing, malware, and high confidence phishing messages are automatically purged even after initial delivery, aligning with CIS M365 7.0.0 benchmark control 2.4.4.",
    "executiveText": "Enables Zero-hour auto purge for Microsoft Teams to automatically detect and remove malicious messages after delivery. This provides an additional layer of protection against phishing and malware that may bypass initial scanning, ensuring threats are neutralised even after they reach users.",
    "addedComponent": [],
    "label": "Ensure Zero-hour auto purge for Microsoft Teams is on",
    "impact": "Low Impact",
    "impactColour": "info",
    "addedDate": "2026-05-06",
    "powershellEquivalent": "Set-TeamsProtectionPolicy -Identity 'Teams Protection Policy' -ZapEnabled $true",
    "recommendedBy": ["CIS"],
    "requiredCapabilities": [
      "EXCHANGE_S_STANDARD",
      "EXCHANGE_S_ENTERPRISE",
      "EXCHANGE_S_STANDARD_GOV",
      "EXCHANGE_S_ENTERPRISE_GOV",
      "EXCHANGE_LITE"
    ]
  },
  {
    "name": "standards.CollaborationDomainRestriction",
    "cat": "Entra (AAD) Standards",
    "tag": ["CIS M365 7.0.0 (5.1.6.1)"],
    "appliesToTest": ["CIS_5_1_6_1"],
    "helpText": "Restricts B2B collaboration invitations to a specified list of allowed domains. If no domains are provided, the standard will alert and report on whether any domain restrictions are currently configured.",
    "docsDescription": "By default, Microsoft Entra ID allows collaboration invitations to be sent to any external domain. CIS recommends restricting B2B collaboration invitations to only approved domains to reduce the risk of data exfiltration and unauthorized access. This standard checks the B2B management policy for an allow list of domains and can remediate by setting the allowed domains list.",
    "executiveText": "Restricts external collaboration invitations to approved domains only, preventing users from sharing data with unapproved external organizations. This reduces the risk of data exfiltration and ensures that collaboration occurs only with trusted business partners.",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.CollaborationDomainRestriction.allowedDomains",
        "label": "Allowed domains (comma separated)",
        "required": false,
        "placeholder": "contoso.com, fabrikam.com"
      }
    ],
    "label": "Restrict collaboration invitations to allowed domains only",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2026-05-06",
    "powershellEquivalent": "Graph API PATCH https://graph.microsoft.com/beta/policies/b2bManagementPolicies/default",
    "recommendedBy": ["CIS"]
  },
  {
    "name": "standards.IntuneAppTemplateDeploy",
    "cat": "Intune Standards",
    "tag": [],
    "helpText": "Deploys selected Intune application templates to the tenant. Supports WinGet/Store apps, Office apps, Chocolatey apps, Win32 script apps, and MSP apps.",
    "docsDescription": "Uses CIPP Intune Application Templates to deploy applications across tenants as a standard. Each template can contain multiple applications of different types which will be queued for deployment.",
    "executiveText": "Automatically deploys approved Intune applications across all managed tenants, ensuring consistent software availability and reducing manual deployment overhead. Supports WinGet, Office, Chocolatey, Win32, and MSP application types.",
    "addedComponent": [
      {
        "type": "autoComplete",
        "multiple": true,
        "creatable": false,
        "label": "Select Application Templates",
        "name": "standards.IntuneAppTemplateDeploy.templateIds",
        "api": {
          "url": "/api/ListAppTemplates",
          "labelField": "displayName",
          "valueField": "GUID",
          "queryKey": "StdIntuneAppTemplateList"
        }
      }
    ],
    "label": "Deploy Intune Application Template",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2026-05-23",
    "powershellEquivalent": "Graph API - /deviceAppManagement/mobileApps",
    "recommendedBy": []
  },
  {
    "name": "standards.AutopatchGroup",
    "cat": "Intune Standards",
    "tag": [],
    "beta": true,
    "deprecated": true,
    "disabledFeatures": { "report": false, "warn": false, "remediate": false },
    "helpText": "Deploys a Windows Autopatch group with configurable deployment ring settings for quality updates, feature updates, Edge, and Office.",
    "docsDescription": "Creates or updates a Windows Autopatch deployment group with Test and Last deployment rings. Configures quality update deferrals, feature update targeting, Edge and Office update channels per ring. Uses the Autopatch API proxy to manage the group configuration.",
    "executiveText": "Configures Windows Autopatch deployment groups to manage update delivery across devices. Autopatch automates Windows quality updates, feature updates, Edge, and Office updates using deployment rings with configurable deferrals and deadlines.",
    "addedComponent": [
      {
        "type": "textField",
        "name": "standards.AutopatchGroup.GroupName",
        "label": "Group Name",
        "required": true,
        "defaultValue": "Autopatch default group"
      },
      {
        "type": "select",
        "multiple": false,
        "name": "standards.AutopatchGroup.TargetOSVersion",
        "label": "Target OS Version",
        "required": true,
        "options": [
          { "label": "Windows 11, version 24H2", "value": "Windows 11, version 24H2" },
          { "label": "Windows 11, version 25H2", "value": "Windows 11, version 25H2" }
        ],
        "defaultValue": "Windows 11, version 25H2"
      },
      {
        "type": "switch",
        "name": "standards.AutopatchGroup.EnableDriverUpdate",
        "label": "Enable Driver Updates",
        "defaultValue": true
      },
      {
        "type": "switch",
        "name": "standards.AutopatchGroup.InstallWin10OnWin11Ineligible",
        "label": "Install latest Windows 10 on Windows 11 ineligible devices",
        "defaultValue": false
      },
      {
        "type": "number",
        "name": "standards.AutopatchGroup.TestQualityDeferral",
        "label": "Test Ring - Quality Update Deferral (days)",
        "defaultValue": 0,
        "validators": {
          "min": { "value": 0, "message": "Minimum value is 0" },
          "max": { "value": 30, "message": "Maximum value is 30" }
        }
      },
      {
        "type": "number",
        "name": "standards.AutopatchGroup.TestQualityDeadline",
        "label": "Test Ring - Quality Update Deadline (days)",
        "defaultValue": 1,
        "validators": {
          "min": { "value": 0, "message": "Minimum value is 0" },
          "max": { "value": 30, "message": "Maximum value is 30" }
        }
      },
      {
        "type": "number",
        "name": "standards.AutopatchGroup.TestQualityGracePeriod",
        "label": "Test Ring - Quality Update Grace Period (days)",
        "defaultValue": 1,
        "validators": {
          "min": { "value": 0, "message": "Minimum value is 0" },
          "max": { "value": 7, "message": "Maximum value is 7" }
        }
      },
      {
        "type": "number",
        "name": "standards.AutopatchGroup.TestFeatureDeferral",
        "label": "Test Ring - Feature Update Deferral (days)",
        "defaultValue": 0,
        "validators": {
          "min": { "value": 0, "message": "Minimum value is 0" },
          "max": { "value": 365, "message": "Maximum value is 365" }
        }
      },
      {
        "type": "number",
        "name": "standards.AutopatchGroup.TestFeatureDeadline",
        "label": "Test Ring - Feature Update Deadline (days)",
        "defaultValue": 5,
        "validators": {
          "min": { "value": 0, "message": "Minimum value is 0" },
          "max": { "value": 30, "message": "Maximum value is 30" }
        }
      },
      {
        "type": "select",
        "multiple": false,
        "name": "standards.AutopatchGroup.TestEdgeChannel",
        "label": "Test Ring - Edge Update Channel",
        "options": [
          { "label": "Stable", "value": "Stable" },
          { "label": "Beta", "value": "Beta" },
          { "label": "Dev", "value": "Dev" }
        ],
        "defaultValue": "Beta"
      },
      {
        "type": "select",
        "multiple": false,
        "name": "standards.AutopatchGroup.TestOfficeChannel",
        "label": "Test Ring - Office Update Channel",
        "options": [
          { "label": "Current", "value": "Current" },
          { "label": "Monthly Enterprise", "value": "MonthlyEnterprise" },
          { "label": "Semi-Annual Enterprise", "value": "SemiAnnual" }
        ],
        "defaultValue": "MonthlyEnterprise"
      },
      {
        "type": "number",
        "name": "standards.AutopatchGroup.TestDnfDeferral",
        "label": "Test Ring - Driver & Firmware Deferral (days)",
        "defaultValue": 0,
        "validators": {
          "min": { "value": 0, "message": "Minimum value is 0" },
          "max": { "value": 30, "message": "Maximum value is 30" }
        }
      },
      {
        "type": "number",
        "name": "standards.AutopatchGroup.LastQualityDeferral",
        "label": "Last Ring - Quality Update Deferral (days)",
        "defaultValue": 1,
        "validators": {
          "min": { "value": 0, "message": "Minimum value is 0" },
          "max": { "value": 30, "message": "Maximum value is 30" }
        }
      },
      {
        "type": "number",
        "name": "standards.AutopatchGroup.LastQualityDeadline",
        "label": "Last Ring - Quality Update Deadline (days)",
        "defaultValue": 2,
        "validators": {
          "min": { "value": 0, "message": "Minimum value is 0" },
          "max": { "value": 30, "message": "Maximum value is 30" }
        }
      },
      {
        "type": "number",
        "name": "standards.AutopatchGroup.LastQualityGracePeriod",
        "label": "Last Ring - Quality Update Grace Period (days)",
        "defaultValue": 2,
        "validators": {
          "min": { "value": 0, "message": "Minimum value is 0" },
          "max": { "value": 7, "message": "Maximum value is 7" }
        }
      },
      {
        "type": "number",
        "name": "standards.AutopatchGroup.LastFeatureDeferral",
        "label": "Last Ring - Feature Update Deferral (days)",
        "defaultValue": 0,
        "validators": {
          "min": { "value": 0, "message": "Minimum value is 0" },
          "max": { "value": 365, "message": "Maximum value is 365" }
        }
      },
      {
        "type": "number",
        "name": "standards.AutopatchGroup.LastFeatureDeadline",
        "label": "Last Ring - Feature Update Deadline (days)",
        "defaultValue": 5,
        "validators": {
          "min": { "value": 0, "message": "Minimum value is 0" },
          "max": { "value": 30, "message": "Maximum value is 30" }
        }
      },
      {
        "type": "select",
        "multiple": false,
        "name": "standards.AutopatchGroup.LastEdgeChannel",
        "label": "Last Ring - Edge Update Channel",
        "options": [
          { "label": "Stable", "value": "Stable" },
          { "label": "Beta", "value": "Beta" },
          { "label": "Dev", "value": "Dev" }
        ],
        "defaultValue": "Stable"
      },
      {
        "type": "select",
        "multiple": false,
        "name": "standards.AutopatchGroup.LastOfficeChannel",
        "label": "Last Ring - Office Update Channel",
        "options": [
          { "label": "Current", "value": "Current" },
          { "label": "Monthly Enterprise", "value": "MonthlyEnterprise" },
          { "label": "Semi-Annual Enterprise", "value": "SemiAnnual" }
        ],
        "defaultValue": "MonthlyEnterprise"
      },
      {
        "type": "number",
        "name": "standards.AutopatchGroup.LastOfficeDeferral",
        "label": "Last Ring - Office Update Deferral (days)",
        "defaultValue": 1,
        "validators": {
          "min": { "value": 0, "message": "Minimum value is 0" },
          "max": { "value": 30, "message": "Maximum value is 30" }
        }
      },
      {
        "type": "number",
        "name": "standards.AutopatchGroup.LastOfficeDeadline",
        "label": "Last Ring - Office Update Deadline (days)",
        "defaultValue": 2,
        "validators": {
          "min": { "value": 0, "message": "Minimum value is 0" },
          "max": { "value": 30, "message": "Maximum value is 30" }
        }
      },
      {
        "type": "number",
        "name": "standards.AutopatchGroup.LastDnfDeferral",
        "label": "Last Ring - Driver & Firmware Deferral (days)",
        "defaultValue": 1,
        "validators": {
          "min": { "value": 0, "message": "Minimum value is 0" },
          "max": { "value": 30, "message": "Maximum value is 30" }
        }
      }
    ],
    "label": "Deploy Windows Autopatch Group",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2025-05-27",
    "powershellEquivalent": "Autopatch API - POST /api/autoPatch",
    "recommendedBy": []
  },
  {
    "name": "standards.FIDO2PasskeyProfiles",
    "cat": "Entra (AAD) Standards",
    "tag": [],
    "helpText": "Configures FIDO2 passkey profiles including AAGUID allowlists, attestation enforcement, and passkey types for the tenant.",
    "docsDescription": "Manages FIDO2 passkey profiles on the tenant authentication methods policy. Allows defining passkey profiles that control which authenticators (hardware keys, password managers, Microsoft Authenticator) are permitted via AAGUID allowlists, whether attestation is enforced, and which passkey types (device-bound, synced, or both) are allowed. This enables MSPs to centrally deploy phishing-resistant MFA configurations across tenants.",
    "executiveText": "Configures passkey (FIDO2) profiles that control which authenticators users can register for phishing-resistant MFA. Supports allowlisting specific hardware keys (e.g., YubiKey models), password managers (e.g., 1Password), and Microsoft Authenticator by AAGUID, with control over attestation enforcement and passkey types.",
    "addedComponent": [
      {
        "type": "select",
        "multiple": false,
        "name": "standards.FIDO2PasskeyProfiles.PasskeyTypes",
        "label": "Allowed Passkey Types",
        "options": [
          { "label": "Device-bound only", "value": "deviceBound" },
          { "label": "Synced only", "value": "synced" },
          { "label": "Both device-bound and synced", "value": "deviceBound,synced" }
        ],
        "required": true
      },
      {
        "type": "select",
        "multiple": false,
        "name": "standards.FIDO2PasskeyProfiles.AttestationEnforcement",
        "label": "Attestation Enforcement",
        "options": [
          { "label": "Disabled (required for synced passkeys)", "value": "disabled" },
          { "label": "Registration only", "value": "registrationOnly" }
        ],
        "required": true
      },
      {
        "type": "switch",
        "name": "standards.FIDO2PasskeyProfiles.EnforceKeyRestrictions",
        "label": "Enforce AAGUID Key Restrictions"
      },
      {
        "type": "select",
        "multiple": false,
        "name": "standards.FIDO2PasskeyProfiles.EnforcementType",
        "label": "Key Restriction Type",
        "options": [
          { "label": "Allow listed AAGUIDs only", "value": "allow" },
          { "label": "Block listed AAGUIDs", "value": "block" }
        ]
      },
      {
        "type": "textField",
        "name": "standards.FIDO2PasskeyProfiles.AAGUIDs",
        "label": "AAGUIDs (comma-separated list of authenticator AAGUIDs)"
      }
    ],
    "label": "Configure FIDO2 Passkey Profile",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2026-05-25",
    "powershellEquivalent": "Graph API PATCH /policies/authenticationMethodsPolicy/authenticationMethodConfigurations/fido2",
    "recommendedBy": ["CIPP"]
  },
  {
    "name": "standards.SmartLockout",
    "cat": "Entra (AAD) Standards",
    "tag": ["CIS M365 7.0.0 (5.2.3.8)", "CIS M365 7.0.0 (5.2.3.9)"],
    "appliesToTest": ["CIS_5_2_3_8", "CIS_5_2_3_9"],
    "helpText": "**Requires Entra ID P1.** Configures the Entra ID Smart Lockout settings including lockout duration, lockout threshold, and on-premises integration mode.",
    "docsDescription": "Configures the Entra ID Smart Lockout policy which protects against brute-force password attacks. Smart Lockout locks out bad actors who try to guess user passwords or use brute-force methods. It recognizes sign-ins from valid users and treats them differently from attackers. Settings include lockout duration (seconds), lockout threshold (failed attempts before lockout), and on-premises password protection mode (Audit or Enforced).",
    "addedComponent": [
      {
        "type": "number",
        "name": "standards.SmartLockout.LockoutDurationInSeconds",
        "label": "Lockout Duration (seconds)",
        "default": 60,
        "required": true
      },
      {
        "type": "number",
        "name": "standards.SmartLockout.LockoutThreshold",
        "label": "Lockout Threshold (failed attempts)",
        "default": 10,
        "required": true
      },
      {
        "type": "switch",
        "name": "standards.SmartLockout.EnableBannedPasswordCheckOnPremises",
        "label": "Enable On-Premises Password Protection"
      },
      {
        "type": "radio",
        "name": "standards.SmartLockout.BannedPasswordCheckOnPremisesMode",
        "label": "On-Premises Mode",
        "options": [
          { "label": "Audit", "value": "Audit" },
          { "label": "Enforced", "value": "Enforced" }
        ]
      }
    ],
    "label": "Configure Entra ID Smart Lockout",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2025-05-27",
    "powershellEquivalent": "Get-MgBetaDirectorySetting, New-MgBetaDirectorySetting, Update-MgBetaDirectorySetting",
    "recommendedBy": ["CIS"],
    "requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2"]
  },
  {
    "name": "standards.SPOVersionControl",
    "cat": "SharePoint Standards",
    "tag": [],
    "helpText": "Configures SharePoint Online file versioning to either use automatic version trimming managed by Microsoft, or enforce a fixed major version limit with optional version expiration.",
    "docsDescription": "Configures the SharePoint Online tenant-level file versioning policy. When automatic version trimming is enabled, Microsoft intelligently manages version cleanup. When disabled, you can set a fixed maximum number of major versions to retain and optionally expire versions after a specified number of days. This helps manage storage consumption while preserving version history as needed.",
    "executiveText": "Controls how SharePoint Online manages file version history at the tenant level. Automatic trimming lets Microsoft optimize storage by cleaning up old versions intelligently. Manual limits give administrators precise control over the maximum number of versions retained and their expiration, ensuring predictable storage usage and compliance with data retention policies.",
    "addedComponent": [
      {
        "type": "switch",
        "name": "standards.SPOVersionControl.EnableAutoTrim",
        "label": "Enable Automatic Version Trimming (Microsoft managed)"
      },
      {
        "type": "number",
        "name": "standards.SPOVersionControl.MajorVersionLimit",
        "label": "Maximum Major Versions (when auto trim is off)",
        "default": 50
      },
      {
        "type": "number",
        "name": "standards.SPOVersionControl.ExpireVersionsAfterDays",
        "label": "Expire Versions After Days (0 = never, when auto trim is off)",
        "default": 0
      },
      {
        "type": "switch",
        "name": "standards.SPOVersionControl.ApplyToExistingSites",
        "label": "Apply to all existing sites and document libraries"
      }
    ],
    "label": "Set SharePoint File Version Limits",
    "impact": "Medium Impact",
    "impactColour": "warning",
    "addedDate": "2026-05-27",
    "powershellEquivalent": "Set-SPOTenant -EnableAutoExpirationVersionTrim $true or Set-SPOTenant -EnableAutoExpirationVersionTrim $false -MajorVersionLimit 50 -ExpireVersionsAfterDays 365",
    "recommendedBy": [],
    "disabledFeatures": {
      "report": false,
      "warn": false,
      "remediate": false
    }
  }
]