Microsoft Entra ID

Admin MFA

User MFA

Login Portal Branding

Self Service Password Reset

Block Legacy Authentication

Inactive Accounts

Risky IP Address Policy

Risky Country Policy

Connected Apps & User Consent

MFA Number Matching

Entra ID Guest User Access Permissions

Temporary Access Pass

Microsoft MFA Campaign

Security Defaults is enabled

Security Defaults is disabled

Privileged role on Control Plane are managed by PIM only

Unused privileged role assignments

All users utilizing an Entra ID P2 license should be licensed.

All users utilizing an Entra ID P1 license should be licensed.

Directory sync accounts & Conditional Access

Application enforced restrictions for unmanaged devices

Enforce sign-in frequency for non-corporate devices

Enforce non-persistent browser session for non-corporate devices

Block access for unknown or unsupported device platforms

Require compliant or Entra hybrid joined devices for admins

Require new password when user risk is high

Require security info registration from a trusted location

Exclude emergency/break glass account or group

Policy targetting All Apps and All Users

Policy targetting All Apps

Enforce credential configurations on apps and service principals

Require device compliance

Guest Invite Settings

Guest Access Restrictions

Number of Global Admins

Passwords should not expire

Configure application admin consent workflow

Only admins allowed to register applications

Register MFA from managed devices

Authenticate from managed devices

Phishing-resistant MFA for highly privileged roles

Disable weakest 2FA authenticators

Authenticator login context information

Phishing-resistant MFA

Block risky sign-ins

Block High Risk Users

Smart Lockout Threshold

Smart Lockout Duration

Banned Password List

On-prem Password Protection

Do Not Allow Banned Passwords

Block Risky Apps

Disable Voice Call MFA

Limit Temporary Access Pass to One-Time User

Read User Information from Directory

Users Are Allowed To Create Apps

Risk-based Step-up Admin Consent for Risky Apps

User Consent Policy for Applications

Guest User Access

Global Admin Role Activation

Highly Privileged Roles Outside of PAM

Permanent Highly Privileged Role Assignments

Hybrid Global Administrators

App Request Expiry

Reviewer App Request Reminders

Reviewer App Request Notifications

Least privilege access

Show Geographic Location in Push and Passwordless Notifications

Show Application Name in Push and Passwordless Notifications

Users Can Report Suspicious Activities

FIDO2 Self-Service Set Up

FIDO2 Security Keys

Sign-in frequency and non-persistent sessions for administrative roles

Restrict non-admin users from creating tenants

Disable weak authentication methods

System-preferred multifactor authentication

Per-user MFA disabled

Ensure users cannot create security groups

Ensure a dynamic group for guest users is created

Block device code sign-in flow

Ensure two emergency access accounts have been defined

Sign-in frequency for Intune Enrollment