The CIS Microsoft 365 Foundations Benchmark is the closest thing the industry has to a standard checklist for Microsoft 365 configuration. It is published by the Center for Internet Security, it is versioned and prescriptive, and it is the first framework many compliance teams reach for.
This is a practical walkthrough: what the benchmark covers, how to think about it, which controls to prioritize, and how to audit against it without drowning.
What the CIS benchmark is
The CIS Microsoft 365 Foundations Benchmark is a set of prescriptive configuration recommendations for Microsoft 365, organized by workload and given control identifiers. It covers the surfaces that matter:
- Identity (Entra ID): MFA, Conditional Access, privileged roles, guest access, legacy authentication
- Exchange Online: mail flow, anti-phishing, mailbox settings
- SharePoint and OneDrive: external sharing, link defaults, sync
- Teams: external and guest access, meeting policies
- Audit and logging: unified audit log, retention
Because it is versioned (currently the v3.x line), you can cite exactly which control and version a finding maps to — which is what auditors want.
How to think about the benchmark
The mistake people make is treating the CIS benchmark as a flat list to grind through. It is not. The controls are not equally important, and the identity controls are where the leverage is.
A useful mental model:
- Identity first. If MFA, Conditional Access, and privileged access are wrong, nothing else matters much. Attackers get in through identity.
- Then the data surfaces. External sharing in SharePoint/OneDrive and guest access in Teams are where sensitive content leaks.
- Then the long tail. Mailbox settings, logging, and the dozens of smaller recommendations.
Which controls to tackle first
If you are starting from scratch, these are the CIS-aligned items with the highest return:
- Require MFA for all users, and separately for privileged roles.
- Block legacy authentication — protocols that cannot enforce MFA bypass Conditional Access entirely.
- Limit standing Global Administrators and move privileged access to just-in-time.
- Restrict guest invitations and external sharing defaults.
- Ensure the unified audit log is enabled so you have evidence at all.
Those five address the controls that show up in almost every real-world incident, and they are the ones a CIS audit is most likely to flag first.
How to audit against CIS
You can assess against the CIS benchmark by hand, control by control, using the Microsoft admin centers and PowerShell. It is thorough and it is slow. Or you can use tooling — CIS-CAT or a hosted audit — to run the checks and get pass/fail per control.
The two operational caveats are the same as with every manual approach:
- Point-in-time. A clean CIS result today is not a clean CIS result next quarter. Configuration drifts.
- Mapping effort. You still have to turn raw results into something a client or auditor can read.
Where a hosted audit fits
A hosted audit runs the CIS Microsoft 365 Foundations checks as one of five benchmarks in a single pass — CIS, CISA SCUBA, EIDSCA, ORCA, and community best practices — across every surface, and maps each finding to its CIS control ID. The output is a dated, severity-ranked PDF you can hand over.
That gives you the CIS evidence without the spreadsheet. Explore the CIS coverage on our CIS benchmark page, or see the deliverable in the sample report.
The short version
The CIS Microsoft 365 Foundations Benchmark is the standard, and it is worth meeting. Do not treat it as a flat checklist — prioritize identity, then data surfaces, then the tail. And run it on a schedule, because the configuration you audited is not the configuration you will have in three months.
Run an audit to see your tenant scored against the CIS benchmark and the rest, in minutes.