Demo data. Read-only, fixture Azure tenant. Nothing here can be changed.
Fixture Subscription
Last run 2026-09-09T03:27:45Z
Pass14
Fail45
Warn41
N/A45
Observed posture
24%
Collection completeness
100%
Accepted risk
0 check(s)
Effective posture
26%
(2 mitigated)
Freshness
2026-09-09T03:27:45Z
Audit readiness
Ready for the audit binder: automated checks plus manually tracked status and evidence. Mapped to, not certified against.
Identity
3 pass
9 fail
9 warn
Network
2 pass
6 fail
4 warn
Storage
2 pass
2 fail
5 warn
Data
2 pass
7 fail
1 warn
Logging
1 pass
3 fail
5 warn
Governance
0 pass
1 fail
2 warn
Compute
0 pass
3 fail
5 warn
Defender
0 pass
1 fail
1 warn
Microsoft Secure Score: 68.2% (Azure says).
ProofKit observed posture: 24%.
ProofKit effective posture with 2 compensating controls: 26%.
Secure Score only sees controls inside the tenant.
Microsoft 365: Entra baseline
4 pass
10 fail
9 warn
Microsoft 365: SharePoint and OneDrive
0 pass
3 fail
Microsoft 365: collected by script
0 pass
0 fail
45 n/a
Checks
From the run on 2026-09-09T03:27:45Z. Full run history › · Access reviews › · Policies › · Microsoft 365 › · Trust center ›
All checks
CIS Azure Foundations
SOC 2
HIPAA
HITRUST CSF
ISO/IEC 27001
NIST SP 800-171 r2 (CMMC Level 2)
NIST CSF 2.0
PCI DSS
CISA SCuBA M365
140 of 145 checks map to HIPAA: 14 pass, 44 fail, 37 warn.
No audit target set for HIPAA yet. · Scope
| Check | Family | Severity | Status | HIPAA control | Affected |
|---|---|---|---|---|---|
| Users without MFA registered | identity | high | fail | 164.312(d) | 3 |
| Conditional Access requires MFA | identity | high | pass | 164.312(d) | |
| Legacy authentication is blocked | identity | high | warn | 164.312(d) | 5 |
| Security defaults or Conditional Access | identity | medium | warn | 164.312(d) | 2 |
| Number of Global Administrators | identity | medium | pass | 164.308(a)(4) | |
| Global Administrators without MFA | identity | high | fail | 164.312(d) | 1 |
| Stale guest accounts | identity | low | warn | 164.308(a)(4) | 2 |
| Stale member accounts | identity | low | warn | 164.308(a)(3)(ii)(C) | 2 |
| Privileged role membership over 5 | identity | medium | warn | 164.308(a)(4) | 6 |
| Guest accounts in a directory role | identity | high | fail | 164.308(a)(4) | 1 |
| Application credentials expired or expiring | identity | high | fail | 164.308(a)(5)(ii)(D) | 1 |
| Application secrets older than 2 years | identity | medium | warn | 164.308(a)(5)(ii)(D) | 1 |
| Non-expiring passwords without MFA | identity | medium | warn | 164.308(a)(5)(ii)(D) | 1 |
| Application credentials expired, expiring, or too long lived | identity | medium | fail | 164.308(a)(5)(ii)(D) | 3 |
| Application credentials with no owner | identity | low | warn | 164.308(a)(4) | 1 |
| Risky OAuth consent grants | identity | high | fail | 164.308(a)(4) | 3 |
| Privileged role members without MFA registered | identity | high | fail | 164.312(d) | 5 |
| Guests stale for 90 days or never signed in | identity | low | warn | 164.308(a)(4) | 2 |
| Successful sign-ins using legacy authentication | identity | high | fail | 164.312(d) | 2 |
| Security defaults or an effective Conditional Access MFA policy | identity | medium | pass | 164.312(d) | |
| Banned password protection and lockout | identity | medium | fail | 164.308(a)(5)(ii)(D) | 2 |
| NSGs open to the internet on management ports | network | high | fail | 164.312(e)(1) | 1 |
| NSGs allowing any port from the internet | network | high | pass | 164.312(e)(1) | |
| VMs with a public IP | network | medium | warn | 164.312(e)(1) | 2 |
| Subnets without an NSG | network | medium | fail | 164.312(e)(1) | 1 |
| Storage accounts open to the public network | network | high | fail | 164.312(e)(1) | 1 |
| SQL server firewall allows every IP | network | high | pass | 164.312(e)(1) | |
| Key vaults open to the public network | network | high | fail | 164.312(e)(1) | 1 |
| No Azure Bastion for VMs with a public IP | network | medium | warn | 164.312(e)(1) | 1 |
| App Service sites not HTTPS-only | network | high | fail | 164.312(e)(1) | 1 |
| App Service minimum TLS version below 1.2 | network | medium | fail | 164.312(e)(2)(ii) | 1 |
| App Service allows plain FTP | network | low | warn | 164.312(e)(1) | 1 |
| Anonymous blob access allowed | storage | high | fail | 164.312(a)(1) | 1 |
| Minimum TLS version below 1.2 | storage | medium | fail | 164.312(e)(2)(ii) | 1 |
| HTTPS not enforced | storage | high | pass | 164.312(e)(1) | |
| Blob soft delete disabled | storage | medium | pass | 164.308(a)(7)(ii)(A) | |
| Shared key access still allowed | storage | low | warn | 164.312(d) | 1 |
| Infrastructure encryption not required | storage | low | warn | 164.312(a)(2)(iv) | 2 |
| Blob versioning disabled | storage | low | warn | 164.308(a)(7)(ii)(A) | 1 |
| File share soft delete disabled | storage | low | warn | 164.308(a)(7)(ii)(A) | 1 |
| Public storage with no private endpoint | storage | low | warn | 164.312(e)(1) | 1 |
| SQL server auditing disabled | data | medium | fail | 164.312(b) | 1 |
| Transparent data encryption disabled | data | high | pass | 164.312(a)(2)(iv) | |
| Defender for SQL disabled | data | medium | fail | 164.308(a)(1)(ii)(D) | 1 |
| Key vault soft delete or purge protection off | data | high | fail | 164.308(a)(7)(ii)(A) | 1 |
| Key vault has no diagnostic logging | data | medium | pass | 164.312(b) | |
| SQL server allows local (SQL) authentication | data | medium | warn | 164.312(d) | 1 |
| SQL Vulnerability Assessment disabled | data | medium | fail | 164.308(a)(1)(ii)(B) | 1 |
| PostgreSQL/MySQL do not require a secure connection | data | high | fail | 164.312(e)(1) | 1 |
| PostgreSQL open to every IP address | data | high | fail | 164.312(e)(1) | 1 |
| Cosmos DB open to every IP address | data | high | fail | 164.312(e)(1) | 1 |
| Activity log not exported | logging | medium | fail | 164.312(b) | 1 |
| No Log Analytics workspace | logging | medium | pass | 164.312(b) | |
| Azure says: Defender for Cloud plans on Free tier | logging | medium | warn | 164.308(a)(1)(ii)(D) | 3 |
| No security contact configured | logging | low | fail | 164.308(a)(6)(i) | 1 |
| Log Analytics retention below 90 days | logging | medium | warn | 164.312(b) | 1 |
| NSGs without a flow log | logging | medium | warn | 164.312(b) | 2 |
| Missing activity log alerts for key changes | logging | medium | fail | 164.308(a)(1)(ii)(D) | 7 |
| Azure says: additional Defender for Cloud plans on Free tier | logging | medium | warn | 164.308(a)(1)(ii)(D) | 2 |
| Custom roles granting unrestricted actions | governance | high | fail | 164.308(a)(4) | 1 |
| Sensitive resource groups without a lock | governance | low | warn | 164.308(a)(7)(ii)(A) | 3 |
| VMs with unmanaged OS disks | compute | medium | fail | 164.308(a)(7)(ii)(A) | 1 |
| Disks without customer-managed key encryption | compute | low | warn | 164.312(a)(2)(iv) | 1 |
| Public VMs without Just-In-Time access | compute | medium | warn | 164.312(a)(1) | 1 |
| VMs without a backup | compute | medium | warn | 164.308(a)(7)(ii)(A) | 2 |
| Windows VMs without automatic updates | compute | low | warn | 164.308(a)(5)(ii)(B) | 1 |
| AKS clusters without Kubernetes RBAC | compute | high | fail | 164.312(a)(1) | 1 |
| AKS API server open to the internet | compute | high | fail | 164.312(e)(1) | 1 |
| VMs without the Azure Monitor Agent | compute | low | warn | 164.308(a)(1)(ii)(D) | 2 |
| High-risk users are blocked | m365_entra | high | fail | 164.308(a)(1)(ii)(D) | 6 |
| High-risk sign-ins are blocked | m365_entra | high | fail | 164.308(a)(1)(ii)(D) | 6 |
| Phishing-resistant MFA is enforced for all users | m365_entra | high | warn | 164.312(d) | 5 |
| Microsoft Authenticator shows sign-in context | m365_entra | high | fail | 164.312(d) | 1 |
| Authentication methods policy migration is complete | m365_entra | high | pass | 164.312(d) | |
| SMS, voice call and email OTP are disabled | m365_entra | high | fail | 164.312(d) | 3 |
| A managed device is required for authentication | m365_entra | medium | warn | 164.312(d) | 5 |
| A managed device is required to register MFA | m365_entra | medium | fail | 164.312(d) | 6 |
| Device code authentication is blocked | m365_entra | medium | fail | 164.312(d) | 6 |
| Only administrators can register applications | m365_entra | high | fail | 164.308(a)(4) | 1 |
| User consent to applications is restricted | m365_entra | high | fail | 164.308(a)(4) | 1 |
| An admin consent workflow is configured | m365_entra | high | pass | 164.308(a)(4) | |
| Application password credential addition is blocked | m365_entra | medium | pass | 164.308(a)(5)(ii)(D) | |
| Privileged accounts are cloud-only | m365_entra | high | pass | 164.308(a)(4) | |
| No permanent active assignment to a highly privileged role | m365_entra | high | warn | 164.308(a)(4) | |
| Privileged roles are provisioned only through PIM | m365_entra | high | warn | 164.308(a)(4) | |
| Global Administrator activation requires approval | m365_entra | high | warn | 164.308(a)(4) | |
| Privileged role assignment triggers an alert | m365_entra | high | warn | 164.308(a)(1)(ii)(D) | |
| Global Administrator activation triggers an alert | m365_entra | high | warn | 164.308(a)(1)(ii)(D) | |
| Other privileged role activation triggers an alert | m365_entra | medium | warn | 164.308(a)(1)(ii)(D) | |
| Only admins and Guest Inviters can invite guests | m365_entra | medium | fail | 164.308(a)(4) | 1 |
| Guest invites are restricted to approved domains | m365_entra | medium | fail | 164.308(a)(4) | |
| Risky AI agents are blocked (Preview) | m365_entra | high | warn | 164.312(d) | 1 |
| SharePoint external sharing is limited | m365_sharepoint | high | fail | 164.308(a)(4) | 1 |
| OneDrive external sharing is limited | m365_sharepoint | high | fail | 164.308(a)(4) | 1 |
| External sharing is restricted to approved domains | m365_sharepoint | high | fail | 164.308(a)(4) | 1 |
| Automatic forwarding to external domains SHALL be disabled | m365_collected | high | na | 164.312(e)(1) | |
| DKIM SHOULD be enabled for all domains | m365_collected | medium | na | 164.312(e)(1) | |
| SMTP AUTH SHALL be disabled | m365_collected | medium | na | 164.312(a)(1) | |
| Contact folders SHALL NOT be shared with all domains | m365_collected | medium | na | 164.312(c)(1) | |
| Calendar details SHALL NOT be shared with all domains | m365_collected | medium | na | 164.312(c)(1) | |
| External sender warnings SHALL be implemented | m365_collected | low | na | 164.312(e)(1) | |
| Mailbox auditing SHALL be enabled | m365_collected | high | na | 164.312(b) | |
| The standard and strict preset security policies SHALL be enabled | m365_collected | high | na | 164.308(a)(5)(ii)(B) | |
| All users SHALL be added to EOP in either the standard or strict preset policy | m365_collected | high | na | 164.308(a)(5)(ii)(B) | |
| All users SHALL be added to Defender for Office 365 in standard or strict | m365_collected | high | na | 164.308(a)(5)(ii)(B) | |
| Sensitive accounts SHALL be added to EOP in the strict preset policy | m365_collected | high | na | 164.308(a)(5)(ii)(B) | |
| Sensitive accounts SHALL be added to Defender for Office 365 in strict | m365_collected | high | na | 164.308(a)(5)(ii)(B) | |
| User impersonation protection SHOULD be enabled for sensitive accounts | m365_collected | medium | na | 164.308(a)(5)(ii)(B) | |
| Domain impersonation protection SHOULD be enabled for agency-owned domains | m365_collected | medium | na | 164.308(a)(5)(ii)(B) | |
| Domain impersonation protection SHOULD be added for key suppliers/partners | m365_collected | low | na | 164.308(a)(5)(ii)(B) | |
| Safe attachments SHOULD be enabled for SharePoint, OneDrive and Teams | m365_collected | medium | na | 164.312(c)(1) | |
| Unified Audit logging SHALL be enabled | m365_collected | high | na | 164.312(b) | |
| A custom policy SHALL protect PII (credit cards, ITIN, SSN at minimum) | m365_collected | high | na | 164.312(c)(1) | |
| The custom policy SHOULD cover Exchange, OneDrive, SharePoint, Teams and Devices | m365_collected | medium | na | 164.312(c)(1) | |
| The custom policy SHOULD block sharing sensitive info with everyone | m365_collected | medium | na | 164.312(c)(1) | |
| User notifications SHOULD be enabled in the custom policy | m365_collected | low | na | 164.312(c)(1) | |
| A restricted-apps list SHOULD be defined for the custom policy | m365_collected | low | na | 164.312(c)(1) | |
| The custom policy SHOULD block device/Bluetooth access to sensitive content | m365_collected | medium | na | 164.312(c)(1) | |
| The CISA-required Exchange Online alert policies SHALL be enabled | m365_collected | medium | na | 164.312(b) | |
| Alerts SHOULD be sent to a monitored address or a SIEM | m365_collected | medium | na | 164.312(b) | |
| Audit logs SHALL be retained for at least 12 months (OMB M-21-31) | m365_collected | medium | na | 164.312(b) | |
| External meeting participants SHOULD NOT request control of shared desktops | m365_collected | low | na | 164.312(a)(1) | |
| Anonymous users SHALL NOT be enabled to start meetings | m365_collected | high | na | 164.312(a)(1) | |
| Anonymous users and dial-in callers SHOULD NOT be admitted automatically | m365_collected | medium | na | 164.312(a)(1) | |
| Internal users SHOULD be admitted automatically | m365_collected | low | na | 164.312(a)(1) | |
| Dial-in users SHOULD NOT be enabled to bypass the lobby | m365_collected | medium | na | 164.312(a)(1) | |
| Meeting recording SHOULD be disabled | m365_collected | low | na | 164.312(a)(1) | |
| Record an event SHOULD NOT be set to Always record | m365_collected | low | na | 164.312(a)(1) | |
| External access for users SHALL only be enabled on a per-domain basis | m365_collected | medium | na | 164.312(a)(1) | |
| Unmanaged users SHALL NOT be enabled to initiate contact with internal users | m365_collected | medium | na | 164.312(a)(1) | |
| Internal users SHOULD NOT initiate contact with unmanaged users | m365_collected | low | na | 164.312(a)(1) | |
| Teams email integration SHALL be disabled | m365_collected | medium | na | 164.312(a)(1) | |
| Only agency-approved Microsoft apps SHOULD be installable | m365_collected | low | na | 164.312(a)(1) | |
| Only agency-approved third-party apps SHOULD be installable | m365_collected | medium | na | 164.312(a)(1) | |
| Only agency-approved custom (sideloaded) apps SHOULD be installable | m365_collected | medium | na | 164.312(a)(1) | |
| An SPF policy SHALL be published for each domain that fails all non-approved senders | m365_collected | high | na | 164.312(e)(1) | |
| A DMARC policy SHALL be published for every second-level domain | m365_collected | high | na | 164.312(e)(1) | |
| The DMARC message rejection option SHALL be p=reject | m365_collected | high | na | 164.312(e)(1) | |
| The DMARC rua contact SHALL include [email protected] | m365_collected | low | na | 164.312(e)(1) | |
| An agency point of contact SHOULD also receive DMARC reports | m365_collected | low | na | 164.312(e)(1) |