Checklist Summary:

Microsoft Entra ID is a cloud-based identity and access control service that provides security and functional capabilities. This Secure Configuration Baseline (SCB) provides specific policies to help secure Microsoft Entra ID.

Checklist Role:

• Active Directory Server
• Client / Server
• Domain Controller
• Domain Member Server
• Office Software
• Virtualization Server

Known Issues:

Not provided.

Target Audience:

The Secure Cloud Business Applications (SCuBA) project run by the Cybersecurity and Infrastructure Security Agency (CISA) provides guidance and capabilities to secure federal civilian executive branch (FCEB) agencies’ cloud business application environments and protect federal information that is created, accessed, shared, and stored in those environments.

Target Operational Environment:

• Managed
• Standalone

Testing Information:

Not provided.

Regulatory Compliance:

Not provided.

Comments/Warnings/Miscellaneous:

Not provided.

Disclaimer:

The information in this document is being provided “as is” for INFORMATIONAL PURPOSES ONLY. CISA does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial entities or commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoritism by CISA. This document does not address, ensure compliance with, or supersede any law, regulation, or other authority. Entities are responsible for complying with any recordkeeping, privacy, and other laws that may apply to the use of technology. This document is not intended to, and does not, create any right or benefit for anyone against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.

Product Support:

CyberSharedServices@cisa.dhs.gov

Point of Contact:

CyberSharedServices@cisa.dhs.gov

Sponsor:

Not provided.

Licensing:

Portions of this document are adapted from documents in Microsoft’s M365 and Azure GitHub repositories. The respective documents are subject to copyright and are adapted under the terms of the Creative Commons Attribution 4.0 International license. Sources are linked throughout this document. The United States government has adapted selections of these documents to develop innovative and scalable configuration standards to strengthen the security of widely used cloud-based software services.

Change History:

checklist approved - 2/1/24
checklist approved - 2/5/24
correcting submission error
correcting submission error
checklist approved - 2/16/24
updated to FINAL - 3/18/2024
Changes Approved - 11/29/2024

Dependency/Requirements:

URL	Description

References:

Reference URL	Description
https://learn.microsoft.com/en-us/entra/external-id/authentication-conditional-access	Provides an understanding of how MFA and device claims are passed from the home tenant to the resource tenant
https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview	To configure the inbound and outbound cross-tenant access settings in Microsoft Entra External ID

NIST checklist record last modified on 11/29/2024