🛡️ SOCRoot — M365 & Entra ID Security Baseline

Tenant: SOCRoot Local Baseline Environment · Client: mock-tenant · Generated 2026-10-03 11:32 UTC

posture score (B)

critical failures

high failures

passing controls

95%

evidence coverage

🎯 Executive Action Plan: Top Remediation Priorities

Prioritized human-actionable recommendations derived from empirical telemetry. Assessment Mode: READ-ONLY (Zero tenant state modifications; remediation requires authorized human execution).

Priority #1 M365-APP-01 No high-risk OAuth consent grants to multi-tenant apps

HIGH

Security Impact: risky app permissions granted: Salesforce Integration:User.Read Mail.ReadWrite; Backup Solution:Files.ReadWrite.All

Remediation: Revoke risky consents; restrict user consent via CA/admin policy; audit service principals quarterly.

👤 Target Owner: Cloud Application / Security Administrator🔄 Retest Condition: Re-run SOCRoot audit; control must transition to PASS

Priority #2 M365-DATA-02 External sharing restricted (OneDrive/SharePoint)

MEDIUM

Security Impact: anonymous/anyone sharing links allowed tenant-wide

Remediation: Set SharePoint/OneDrive sharing to 'Existing guests' or stricter; expire guest links.

👤 Target Owner: Exchange & Compliance Administrator🔄 Retest Condition: Re-run SOCRoot audit; control must transition to PASS

Priority #3 M365-APP-02 User consent to apps blocked or restricted tenant-wide

MEDIUM

Security Impact: users may consent to third-party apps tenant-wide

Remediation: Set 'Do not allow user consent' (admin-consent workflow instead).

👤 Target Owner: Cloud Application / Security Administrator🔄 Retest Condition: Re-run SOCRoot audit; control must transition to PASS

❌ Failed Controls (3)

HIGH	M365-APP-01	No high-risk OAuth consent grants to multi-tenant apps risky app permissions granted: Salesforce Integration:User.Read Mail.ReadWrite; Backup Solution:Files.ReadWrite.All Remediation: Revoke risky consents; restrict user consent via CA/admin policy; audit service principals quarterly. CIS — · NCA ECC — · evidence: snapshot://00000000-0000-4000-8000-000000000001/M365-APP-01
MEDIUM	M365-DATA-02	External sharing restricted (OneDrive/SharePoint) anonymous/anyone sharing links allowed tenant-wide Remediation: Set SharePoint/OneDrive sharing to 'Existing guests' or stricter; expire guest links. CIS — · NCA ECC — · evidence: snapshot://00000000-0000-4000-8000-000000000001/M365-DATA-02
MEDIUM	M365-APP-02	User consent to apps blocked or restricted tenant-wide users may consent to third-party apps tenant-wide Remediation: Set 'Do not allow user consent' (admin-consent workflow instead). CIS — · NCA ECC — · evidence: snapshot://00000000-0000-4000-8000-000000000001/M365-APP-02

⚠️ Warnings (3)

M365-AUTH-02	All privileged roles have MFA-capable members only (registration campaign visible) partial coverage: {'enabled': 6, 'total': 7} Remediation: Enforce MFA via CA for ALL privileged roles; require phishing-resistant methods for GA.
M365-ID-05	Directory guest access reviewed (guest users present) 1 guest account(s) — verify sponsorship & expiry Remediation: Enable guest access reviews; expire idle guests; block guest invitation abuse via CA.
M365-ID-06	Stale disabled-but-licensed accounts cleaned up 1 disabled licensed account(s) — reclaim licenses & remove access Remediation: Offboarding must disable AND unlicense AND revoke tokens.

✅ Passing Controls (15)

M365-ID-01 — Security defaults or equivalent baseline Conditional Access enforced
M365-ID-02 — Conditional Access policies exist and are not report-only
M365-AUTH-01 — Legacy authentication blocked
M365-ID-03 — Global Administrator count within 2-4 (break-glass excluded)
M365-ID-04 — Privileged accounts use the primary tenant domain (cloud-only hygiene)
M365-DEV-01 — Devices enrolled and compliance-managed (Intune)
M365-AUD-01 — Unified audit log enabled
M365-AUTH-03 — Self-service password reset configured
M365-CA-01 — CA policy requires MFA for all users (not admins only)
M365-CA-02 — Device-compliance grant present (Intune integration with CA)
M365-PWD-01 — Password expiration policy sane (>=90d or modern passwordless posture)
M365-PST-02 — Secure Score trend stable or improving (last 2 samples)
M365-PST-01 — Secure Score tracked and above 60% (trend evidence)
M365-ID-07 — Privileged role assignments reviewed — no unknown external principals
M365-ID-08 — Break-glass redundancy present (>=2 Global Administrators)

ℹ️ Data Quality & Scope

0 control(s) marked NOT APPLICABLE — no telemetry collected this run; they are NOT counted as compliant.
1 control(s) marked COVERAGE GAP — required evidence not collected; determination deferred pending data collection.
Verification mode: audit derived from validated deterministic snapshot.

➖ Not Applicable (0)

None.

❓ Coverage Gaps (1)

M365-DATA-01 — No suspicious mailbox forwarding rules to external domains
COVERAGE_GAP: inbox-rule collection unavailable in this snapshot