Cybersecurity and Infrastructure Security Agency Logo

Secure Cloud Business Applications (SCuBA)

Baseline Documents

Light mode

Details

Azure Active Directory Baseline Report

The ScubaGear configuration file provides the capability to exclude specific users or groups from some of the Entra ID policy checks. Exclusions must only be used if they are approved within an organization's security risk acceptance process. See this section in the product documentation for a list of the policies that accept exclusions and the instructions for setting up exclusions in the configuration file. Exclusions can introduce grave risks to your system and must be managed carefully.

Tenant Display NameTenant Domain NameReport DateBaseline VersionModule Version
tqhjytqhjy.onmicrosoft.com10/15/2026 21:46:53 Coordinated Universal Time12.0.0
Policy Indicators:
BOD 25-01 Requirement Required by CISA BOD 25-01
Automated Check Automatically verified by ScubaGear
Configurable Customizable via config file
Manual Requires manual verification

AAD-1 Legacy Authentication

Control IDRequirementResultCriticalityDetails
MS.AAD.1.1v1Legacy authentication SHALL be blocked.
BOD 25-01 RequirementAutomated CheckConfigurable
FailShall0 conditional access policy(s) found that meet(s) all requirements.

Near miss: MS.AAD.1.1v1 Legacy authentication SHALL be blocked would pass if the config file is updated to include: user exclusions. View all CA policies. Run the Start-SCuBAConfigAnalyzer cmdlet and import your ScubaResults JSON file to determine which specific exclusions to add to the configuration file.

AAD-2 Risk-based Policies

Control IDRequirementResultCriticalityDetails
MS.AAD.2.1v1Users detected as high risk SHALL be blocked.
BOD 25-01 RequirementAutomated CheckConfigurable
PassShall1 conditional access policy(s) found that meet(s) all requirements:
MS.AAD.2.1v1 Users detected as high risk SHALL be blocked. View all CA policies
MS.AAD.2.2v1A notification SHOULD be sent to the administrator when high-risk users are detected.
Manual
N/AShould/Not-ImplementedThis product does not currently have the capability to check compliance for this policy. See Secure Configuration Baseline policy for instructions on manual check
MS.AAD.2.3v1Sign-ins detected as high-risk SHALL be blocked.
BOD 25-01 RequirementAutomated CheckConfigurable
PassShall1 conditional access policy(s) found that meet(s) all requirements:
MS.AAD.2.3v1 Sign-ins detected as high risk SHALL be blocked. View all CA policies

AAD-3 Strong Authentication and a Secure Registration Process

Control IDRequirementResultCriticalityDetails
MS.AAD.3.1v1Phishing-resistant MFA SHALL be enforced for all users.
BOD 25-01 RequirementAutomated CheckConfigurable
FailShall0 conditional access policy(s) found that meet(s) all requirements. View all CA policies
MS.AAD.3.2v2MFA SHALL be enforced for all users.
BOD 25-01 RequirementAutomated CheckConfigurable
PassShall1 conditional access policy(s) found that meet(s) all requirements:
MS.AAD.3.2v1 If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users. View all CA policies
MS.AAD.3.3v2If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.
BOD 25-01 RequirementAutomated Check
PassShallRequirement met
MS.AAD.3.4v1The "Authentication methods manage migration" feature SHALL be set to "Migration complete."
BOD 25-01 RequirementAutomated Check
PassShallRequirement met
MS.AAD.3.5v2The authentication methods of short message service (SMS), voice call, and email one-time passcode (OTP) SHALL be disabled.
BOD 25-01 RequirementAutomated Check
PassShallRequirement met
MS.AAD.3.6v1Phishing-resistant MFA SHALL be required for highly privileged roles.
BOD 25-01 RequirementAutomated CheckConfigurable
FailShall0 conditional access policy(s) found that meet(s) all requirements. View all CA policies
MS.AAD.3.7v1Managed devices SHOULD be required for authentication.
Automated CheckConfigurable
WarningShould0 conditional access policy(s) found that meet(s) all requirements. View all CA policies
MS.AAD.3.8v1Managed devices SHOULD be required to register MFA.
Automated CheckConfigurable
WarningShould0 conditional access policy(s) found that meet(s) all requirements. View all CA policies
MS.AAD.3.9v1Device code authentication SHOULD be blocked.
Automated CheckConfigurable
WarningShould0 conditional access policy(s) found that meet(s) all requirements.

Near miss: MS.AAD.3.9v1 Device code authentication SHOULD be blocked would pass if the config file is updated to include: user exclusions, group exclusions. View all CA policies. Run the Start-SCuBAConfigAnalyzer cmdlet and import your ScubaResults JSON file to determine which specific exclusions to add to the configuration file.

AAD-4 Centralized Log Collection

Control IDRequirementResultCriticalityDetails
MS.AAD.4.1v1Security logs SHALL be sent to the agency's security operations center for monitoring.
Manual
N/AShall/Not-ImplementedThis product does not currently have the capability to check compliance for this policy. See Secure Configuration Baseline policy for instructions on manual check

AAD-5 Application Registration and Consent

Control IDRequirementResultCriticalityDetails
MS.AAD.5.1v1Only administrators SHALL be allowed to register applications.
BOD 25-01 RequirementAutomated Check
FailShall1 authorization policies found that allow non-admin users to register third-party applications:
authorizationPolicy
MS.AAD.5.2v1User consent to applications SHALL be restricted.
BOD 25-01 RequirementAutomated Check
FailShall1 authorization policies found that allow non-admin users to consent to third-party applications with risky delegated permission classifications:
authorizationPolicy
MS.AAD.5.3v1An administrative consent workflow SHALL be configured for applications.
BOD 25-01 RequirementAutomated Check
PassShallRequirement met
MS.AAD.5.5v1Application password addition SHOULD be blocked.
Automated Check
PassShouldRequirement met
MS.AAD.5.6v1Application password lifetime SHOULD be restricted to 180 days or less.
Automated Check
PassShouldRequirement met
MS.AAD.5.7v1Application certificate lifetime SHOULD be restricted to 365 days or less.
Automated Check
PassShouldRequirement met

AAD-6 Passwords

Control IDRequirementResultCriticalityDetails
MS.AAD.6.1v1User passwords SHALL NOT expire.
BOD 25-01 RequirementAutomated Check
FailShallRequirement not met

AAD-7 Highly Privileged User Access

Control IDRequirementResultCriticalityDetails
MS.AAD.7.1v1A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role.
BOD 25-01 RequirementAutomated Check
PassShall2 global admin(s) found:
Jane Doe, John Public
MS.AAD.7.2v1Privileged users SHALL be provisioned with finer-grained roles instead of the Global Administrator role.
BOD 25-01 RequirementAutomated Check
FailShallRequirement not met: Least Privilege Score = 2 (should be 1 or less) Calculated by 2 global admins / 1 privileged users without global admin role
MS.AAD.7.3v1Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers.
BOD 25-01 RequirementAutomated Check
PassShall0 admin(s) that are not cloud-only found
MS.AAD.7.4v1Permanent active role assignments SHALL NOT be allowed for highly privileged roles.
BOD 25-01 RequirementAutomated CheckConfigurable
FailShall6 role(s) that contain users with permanent active assignment:
Application Administrator, Cloud Application Administrator, Exchange Administrator, Global Administrator, SharePoint Administrator, User Administrator
MS.AAD.7.5v1Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system.
BOD 25-01 RequirementAutomated Check
FailShall4 role(s) assigned to users outside of PIM:
Exchange Administrator, Global Administrator, SharePoint Administrator, User Administrator
MS.AAD.7.6v1Activation of the Global Administrator role SHALL require approval.
BOD 25-01 RequirementAutomated Check
FailShall1 role(s) or group(s) allowing activation without approval found:
Global Administrator(Directory Role)
MS.AAD.7.7v1Eligible and active highly privileged role assignments SHALL trigger an alert.
BOD 25-01 RequirementAutomated Check
FailShall6 role(s) or group(s) without notification e-mail configured for role assignments found:
Cloud Application Administrator(Directory Role), Exchange Administrator(Directory Role), Global Administrator(Directory Role), Hybrid Identity Administrator(Directory Role), Privileged Role Administrator(Directory Role), SharePoint Administrator(Directory Role)
MS.AAD.7.8v1User activation of the Global Administrator role SHALL trigger an alert.
BOD 25-01 RequirementAutomated Check
PassShall0 role(s) or group(s) without notification e-mail configured for Global Administrator activations found
MS.AAD.7.9v1User activation of other highly privileged roles SHOULD trigger an alert.
Automated Check
WarningShould5 role(s) or group(s) without notification e-mail configured for role activations found:
Cloud Application Administrator(Directory Role), Exchange Administrator(Directory Role), Hybrid Identity Administrator(Directory Role), Privileged Role Administrator(Directory Role), SharePoint Administrator(Directory Role)

AAD-8 Guest User Access

Control IDRequirementResultCriticalityDetails
MS.AAD.8.1v1Guest users SHOULD have limited or restricted access to Microsoft Entra ID directory objects.
Automated Check
PassShouldPermission level set to "Limited access" (authorizationPolicy)
MS.AAD.8.2v1Only users with the "Guest Inviter" role SHOULD be able to invite guest users.
Automated Check
WarningShouldPermission level set to "adminsGuestInvitersAndAllMembers" (authorizationPolicy)
MS.AAD.8.3v1Guest invites SHOULD only be allowed to be sent to specific external domains that have been authorized by the agency for legitimate business purposes.
Manual
N/AShould/Not-ImplementedThis product does not currently have the capability to check compliance for this policy. See Secure Configuration Baseline policy for instructions on manual check

AAD-9 AI Security

Control IDRequirementResultCriticalityDetails
MS.AAD.9.1v1Risky AI agents SHALL be blocked.
BOD 25-01 RequirementAutomated Check
FailShall0 conditional access policy(s) found that meet(s) all requirements. View all CA policies

Tenant Licensing Information

Product NameLicense SKU IdentifierLicenses in UseTotal Licenses
Unknown SKU NameCOPILOT_FOR_MICROSOFT_365_GCC310
Common Data Service Database Capacity for GovernmentCDS_DB_CAPACITY_GOV01
Microsoft 365 GCC G5M365_G5_GCC2730
Microsoft Copilot Studio for GCCPower_Virtual_Agents_for_GCC_GCC010

Service Principals with Privileged Role Assignments

Display NameService Principal IDRolesApp ID
Example Service Principal3cf31598-f86b-4a91-95e7-2858ad72a52eExchange Administratorf957755a-cd45-46f4-962c-ceb309e81286

Users with Privileged Roles

Display NameObject IDRolesOn-Prem Immutable ID
Jane DoeExchange Administrator, Global Administrator, SharePoint Administrator
John PublicHybrid Identity Administrator, Privileged Role Administrator, Application Administrator, Exchange Administrator, User Administrator, Cloud Application Administrator, Global Administrator, SharePoint Administrator
John DoeExchange Administrator, SharePoint Administrator, SharePoint Administrator