Widest coverage
The largest single baseline — 170+ tests spanning every major M365 workload and many edge configurations.
Benchmark · Community
Community Best Practices.
Automated. One report.
A broad baseline of best-practice checks curated by the open-source security community, covering configuration areas that general benchmarks sometimes miss.
About the baseline
What is Community?
The Community Best Practices baseline is a living collection of checks contributed and reviewed by the open-source M365 security community. Where CIS and SCuBA focus on formal controls, the community baseline captures practical, hard-won knowledge — the specific settings that show up again and again in real M365 incidents. It is the widest single baseline available and is updated continuously as Microsoft's platform changes.
- Maintainer
- Open-source security community
- Coverage
- 170+ best-practice tests
- License
- MIT
Capabilities
What Community covers
The baseline's scope — we run these checks against your tenant and report the results.
Continuously updated
Updated as Microsoft ships changes to the platform, so new settings and deprecations are reflected quickly.
Real-world focus
Prioritizes the misconfigurations that actually appear in incidents over theoretical hardening.
Community-reviewed
Each check is contributed and reviewed in the open, with rationale documented alongside the test.
Surface area
Where it looks
Entra IDExchange OnlineMicrosoft TeamsSharePointDefender
Use cases
When it earns its keep
Broad health check
When you want the widest possible view of a tenant's configuration in one run rather than a single framework's view.
Continuous monitoring
Run the community baseline on a schedule to catch drift across the full surface, not just the controls a framework names.
Gap-finding between frameworks
Use it alongside CIS or SCuBA to catch practical issues that formal control sets do not enumerate.
Other benchmarks
Add another framework
CIS M365
CIS Microsoft 365 Foundations Benchmark v3.1.0 — 60+ tests across Entra ID, Exchange, Teams, and SharePoint.
CISA SCuBA
US CISA Secure Cloud Business Applications baselines — 70+ tests covering identity, access, devices, and apps.
EIDSCA
Entra ID Security Config Analyzer baseline — 60+ tests from the Microsoft Entra ID Attack and Defense Playbook.
One credit. One tenant. One report.
Run Community against a Microsoft 365 tenant and get a severity-ranked PDF. Credits never expire.