If identity is the front door to your Microsoft 365 tenant, EIDSCA is the checklist for whether that door is actually locked. EIDSCA — the Entra ID Security Config Analyzer — is an open-source configuration baseline for Microsoft Entra ID (formerly Azure Active Directory), and it has become one of the reference points for assessing identity security configuration.
This post explains what EIDSCA is, what it checks, why it matters more than most people assume, and how to run it.
What EIDSCA is
EIDSCA is a set of security configuration controls for Entra ID, published as part of the Entra ID Attack and Defense Playbook. It defines a baseline for how an Entra ID tenant should be configured, organized into controls with identifiers (the AADSxxxx family) so findings can be tracked and mapped.
It is not a product. It is a baseline — a definition of good — plus tooling to assess a tenant against it.
What EIDSCA checks
EIDSCA focuses squarely on identity configuration: the settings that determine who can get in, how, and with what privileges. That includes areas like:
- Authentication methods policy and which methods are enabled
- Conditional Access baseline coverage
- Self-service password reset and authentication registration behavior
- Application consent and permission-grant policies
- Guest and external collaboration defaults
- Privileged role configuration and standing access
- Tenant-wide identity defaults that quietly weaken everything else
Because these are the settings attackers target first, EIDSCA findings tend to be high-signal. A single misconfigured default can undermine an otherwise solid tenant.
Why identity config matters most
Most Microsoft 365 breaches do not start with a clever exploit. They start with an identity: a password spray against an account without MFA, a legacy protocol that bypasses Conditional Access, a stale admin account nobody removed, or a consent grant that hands an app broad access.
That is why every serious framework — CIS, CISA SCUBA, EIDSCA — leads with identity. If your identity configuration is weak, everything downstream is exposed: mail, files, Teams, devices.
EIDSCA gives you a structured way to check that identity layer against a real baseline instead of vibes.
How to run EIDSCA
EIDSCA is open source and read-only. You assess your tenant against the baseline and get findings mapped to control IDs. In practice, running it by hand means pulling it down, granting read-only access, executing it, and reading the output.
Two operational caveats:
- It is Entra-only. EIDSCA will not tell you about Exchange mail flow, Teams guest access, SharePoint sharing, or Defender configuration. Those need their own coverage.
- It is point-in-time. A clean EIDSCA result today says nothing about the change someone makes tomorrow. Identity drift is constant.
Where a full audit picks up
A complete Microsoft 365 audit runs EIDSCA and the other frameworks in one pass, across every surface:
- CIS Microsoft 365 Foundations for broad configuration coverage
- CISA SCUBA for the government baseline
- ORCA for Exchange Online depth
- EIDSCA for the Entra ID identity baseline
- Community best practices for the long tail
Every finding is mapped to its control and ranked by severity, and it lands in a client-ready report. You can browse the identity-relevant benchmark detail on our EIDSCA benchmark page, or see the full deliverable in the sample report.
The short version
EIDSCA is one of the best free baselines for Entra ID, and identity is the right place to start any Microsoft 365 security review. Use it — but remember it is one surface and one point in time. A real audit covers identity and everything identity protects, and turns the result into something you can act on and hand over.
Run an audit to see your tenant's identity configuration scored against EIDSCA and the rest, in minutes.