CIS M365 & Google Workspace Baseline Explorer

Entra Admin Center → Protection → Conditional Access → Policies

1. Create or edit a Conditional Access policy targeting all built-in Entra directory admin roles.
2. Under Grant controls, require Authentication strength → Phishing-resistant MFA.
3. Exclude only your two monitored emergency-access (break-glass) accounts.

Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess"
New-MgIdentityConditionalAccessPolicy -DisplayName "Pharos: Require Admin Phishing-Resistant MFA" -State "enabled"

Entra Admin Center → Identity → Overview → Properties → Security defaults (or Conditional Access)

1. Verify every active member and guest user is covered by Conditional Access MFA or Security Defaults.
2. Review excluded groups to ensure temporary onboarding exemptions have been removed.

Get-MgReportAuthenticationMethodUserRegistrationDetail -All | Where-Object { -not $_.IsMfaRegistered }

Entra Admin Center → Identity → Roles & admins → Global Administrator

1. Review all accounts permanently assigned the Global Administrator role.
2. Downgrade day-to-day admins to least-privilege roles such as User Administrator or Exchange Administrator.
3. Retain 2 dedicated cloud-only emergency access accounts protected by FIDO2 hardware keys.

$role = Get-MgDirectoryRole -Filter "DisplayName eq 'Global Administrator'"
Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id

Entra Admin Center → Identity → Users → All users

1. Inspect Global Administrator accounts and verify OnPremisesSyncEnabled is false.
2. Create dedicated cloud-only admin accounts (*.onmicrosoft.com) separate from daily email accounts.

Entra Admin Center → Protection → Conditional Access → Block Legacy Authentication

1. Create a Conditional Access policy targeting All users.
2. Under Conditions → Client apps, check Exchange ActiveSync clients and Other clients.
3. Under Access controls → Grant, select Block access.

Set-OrganizationConfig -DefaultAuthenticationPolicy "Block-Legacy-Auth"

Microsoft Defender Portal → Email & collaboration → Policies & rules → Threat policies → Anti-spam → Outbound spam

1. Edit the default Outbound spam filter policy.
2. Set Automatic forwarding rules to Off — Forwarding is disabled.
3. Audit existing mailbox ForwardingSmtpAddress values and remove unauthorized external targets.

Set-HostedOutboundSpamFilterPolicy -Identity Default -AutoForwardingMode Off

SharePoint Admin Center → Policies → Sharing

1. Slide SharePoint and OneDrive external sharing down from "Anyone" to "New and existing guests" or "Existing guests".
2. Set default sharing link type to "Specific people (only the people the user specifies)".

Set-SPOTenant -SharingCapability ExistingExternalUserSharingOnly -DefaultSharingLinkType Direct

Entra Admin Center → Identity → External Identities → External collaboration settings

1. Set Guest user access restrictions to "Guest user access is restricted to properties and memberships of their own directory objects".
2. Set Guest invite settings to "Only users assigned to specific admin roles can invite guest users".

Entra Admin Center → Identity → Applications → Enterprise applications → Consent and permissions

1. Select "Do not allow user consent" or "Allow user consent for apps from verified publishers, for selected permissions (Low impact)".
2. Enable the Admin consent workflow so users can request review with a business justification.

Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions @{PermissionGrantPoliciesAssigned = @()}

Microsoft Purview Portal → Solutions → Audit

1. Verify Unified Audit Logging is turned On for the organization.
2. Enable mailbox auditing by default across all user and shared mailboxes.

Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true
Set-OrganizationConfig -AuditDisabled $false

Google Admin Console → Security → Authentication → 2-Step Verification

1. Select your Admin organizational unit (OU) or group.
2. Turn Enforcement ON and set Allowed methods to "Only security key".
3. Verify backup security keys are registered for each Super Admin.

gam update org "/Admins" twostepverification enforcement on method security_key

Google Admin Console → Security → Authentication → 2-Step Verification

1. At the root Organizational Unit, check "Allow users to turn on 2-Step Verification".
2. Set Enforcement to ON with a 7–14 day enrollment grace period for new hires.
3. Set Allowed methods to "Any except verification codes via text, phone call".

Google Admin Console → Account → Admin roles → Super Admin

1. Audit all users assigned the Super Admin role.
2. Reassign routine administrators to delegated roles (User Management Admin, Groups Admin, Help Desk Admin).
3. Remove daily Gmail/Calendar licenses from dedicated Super Admin accounts.

gam print admins role "Super Admin"

Google Admin Console → Apps → Google Workspace → Gmail → End User Access

1. Disable POP and IMAP access for all standard user organizational units, allowing only approved OAuth mail clients.
2. Ensure Less Secure Apps access remains disabled across the domain.

Google Admin Console → Apps → Google Workspace → Gmail → End User Access → Automatic forwarding

1. Uncheck "Allow users to automatically forward incoming email to another address".
2. Review existing user forwarding addresses and filters via GAM or Admin audit logs.

gam all users print forward

Google Admin Console → Apps → Google Workspace → Drive and Docs → Sharing settings

1. Set Default link sharing for new files to "OFF — Only specific people can access".
2. Under Sharing outside of organization, require warning prompts and restrict sharing to allowlisted domains or authenticated guests.

Google Admin Console → Security → Access and data control → API controls → Manage Google Services

1. Set Gmail, Google Drive, and Admin Directory Google Services to "Restricted" so only explicitly trusted OAuth apps can request scopes.
2. Under Unconfigured third-party apps, select "Don’t allow users to access any third-party apps" or allow only internal/trusted apps.

Google Admin Console → Rules → System defined rules

1. Enable email notifications and Alert Center severity High for Admin privilege granted, User suspended, and Government-backed attack warning.
2. Configure Drive data exfiltration threshold rules.