CIS Microsoft 365 Foundation Level 1 - Azure Active Directory

Jonas Bøgvad

2 Oct 2022

Let me show you how to implement the CIS Microsoft 365 Foundation Level 1. We will focus on Azure AD and how to implement the controls.

Introduction to Center for Internet Security also known as CIS

💡

The CIS Controls™ are a prioritized set of actions that collectively form a defense-in-depth set of best practices that mitigate the most common attacks against systems and networks. The CIS Controls are developed by a community of IT experts who apply their first-hand experience as cyber defenders to create these globally accepted security best practices. The experts who develop the CIS Controls come from a wide range of sectors including retail, manufacturing, healthcare, education, government, defense, and others.

CIS Logo

CIS Microsoft 365 Foundation Level 1

The goal of the Microsoft 365 Foundations Benchmark is to help organizations set up a basic level of security for anyone who wants to use Microsoft 365. The benchmark is for system and application administrators, security experts, auditors, help desk and platform deployment staff who want to build, deploy, test, or secure solutions that use Microsoft 365.

As we can see from the screenshot, the assessment template covers more than one Control title. I want to show you how Azure Active Directory and our identity work. Remember, everything you decide to implement should be done so with caution⚠️

💡

Before we begin, I must inform you that this is a Premium Template provided by the compliance manager.

Azure Active Directory Control titles

Designate between two and four global administrators
Enable conditional access policies to block legacy authentication
Enabled identity protection to identify anomalous logon behavior
Ensure modern authentication for Exchange Online, Sharepoint and Skype for Business is enabled (bundled)
Ensure multifactor authentication is enabled for all users in administrative roles
Ensure security defaults is disabled on Azure Active Directory
Ensure self-service password reset is enabled
Ensure that Office 365 passwords are not set to expire
Ensure that password protection is enabled for Active Directory

Designate between two and four global administrators

Global Administrator also known as GA is the most powerful role and should only be given to a small number of accounts, like our Break the Glass account.

Option 1 - Roles and administrators

By going to Azure AD and Roles and administrators search for Global Admin, we can look for users in our tenant and see who is a Global Administrator (GA).

Option 2 - Privileged Identity Management

If we have Azure AD P2, we can use Privileged Identity Management (PIM) to find out who the GA is. If you want users to be able to use GA, you should never make them permanent. Instead, they should only be able to use it if a second approver and a good reason are given.

Enable conditional access policies to block legacy authentication

⚠️The best way to protect your environment is to block legacy/basic authentication and instead use the new authentication standards that come with Primary Refresh Token (PRT). By turning off legacy authentication, we turn on Modern Authentication by default, since we sign in to our SaaS apps with Azure AD. We can quickly stop legacy authentication by using the Conditional Access templates. Just be careful and set it to report only if you need an overview first.

Read my post if you want to find out what a primary refresh token is.

Enabled identity protection to identify anomalous logon behavior

To see anomalous logon behavior we will need Azure P2, which includes Identity Protection to show us User risk and Sign-in risk. What the control is requiring is logon behavior which goes under Sign-in risk. Identity Protection is able to do the following:

Automate how identity-based risks are found and fixed.
Use the data in the portal to look into risks.
You can send data about risk detection to other tools.

Ensure modern authentication for Exchange Online, Sharepoint and Skype for Business is enabled

Enabling Modern Authentication (MA) for Exchange Online (EXO), Sharepoint(SP), Skype for Business (SFB) will give us the possibility to challenge our users with different kind of conditions and access policies especially for our internet facing application.

Here is the per service state of modern authentication by default for tenants created before August 1, 2017:

Skype for Business Online - OFF by default.
Exchange Online - OFF by default.
SharePoint Online - ON by default.

Related CIS version 8 controls: 6.3 Require MFA🟢 for Externally-Exposed Applications Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported. Enforcing MFA through a directory service or SSO✅ provider is a satisfactory implementation of this Safeguard.

Required

Single-Sign On = ✅
Multi-Factor Authentication = 🟢

Not required but recommended

Conditional Access = 👮
Moderen approach = 👌
Legacy = 🪨

Ensure modern authentication for Exchange Online is enabled

EXO is a native Microsoft SaaS, which natively supports Modern Authentication. Whenever you gain access, token-based authentication is used so long as you authenticate via Azure AD. Legacy option would be EXO Hybrid Modern Authentication.

Exchange Online Hybrid Modern Authentication 🪨✅🟢👮
Exchange Online as SaaS only 👌✅🟢👮

Ensure modern authentication for Skype for Business is enabled

If you use SFB, you are either using Cloud-only (Skype for Business Online and Azure AD Auth) or on-premises this is where it can get a bit tricky, but the recommendation is using Skype for Business Hybrid Modern Authentication.

Skype for Business Hybrid Modern Authentication 🪨✅🟢👮
Skype for Business Online 👌✅🟢👮

illustrate SFB and SFBO with Modern Authentication

Skype for Business

Connect to Skype for Business Online using remote PowerShell, run the following command:

Allowed Verify that the change was successful by running the following: Get-CsOAuthConfiguration

Skype for Business Online: Enable your tenant for modern authentication - TechNet Articles - United States (English) - TechNet Wiki

Technical articles, content and resources for IT Professionals working in Microsoft technologies

TechNet WikiDan Strader

Skype for Business Hybrid Modern Authentication

Connect to your Exchange on-prem servers and run the following command:

Get-OrganizationConfig | ft OAuth*
If the value of the OAuth2ClientProfileEnabled property is False, then modern authentication is disabled.

Recommend following Microsoft documentation if disabled.

Hybrid Modern Authentication overview and prerequisites for use with on-premises Skype for Business and Exchange servers - Microsoft 365 Enterprise

In this article, you will learn about Hybrid Modern Authentication and the prerequisites for use with on-premises Skype for Business and Exchange servers.

Microsoft Learnkelleyvice-msft

Ensure modern authentication for Sharepoint is enabled

Sharepoint (SP) we are able to host our sites on-prem or in the cloud, if we are using Sharepoint in the cloud it is called Sharepoint Online (SPO) and supports natively Modern Authentication with Azure AD, or we are hosting it on-prem.

SharePoint Server with Microsoft Azure Active Directory (Azure AD)✅🟢👮
Sharepoint Online 👌✅🟢👮

SharePoint Server with Microsoft Azure Active Directory (Azure AD)

Federated authentication between Azure Active Directory and SharePoint on-premises. The goal is to allow users to sign in on Azure Active Directory and use their identity to access the SharePoint on-premises sites.

Tutorial: Azure Active Directory integration with SharePoint on-premises - Microsoft Entra

Learn how to implement federated authentication between Azure Active Directory and SharePoint on-premises.

Microsoft Learnjeevansd

Conditional Access Policy for Office 365 (EXO, SP, SfB)

If we are authenticated via Azure AD, you should have a conditional access policy in place that includes either each individual cloud application or Office 365, which includes multiple native Microsoft SaaS.

The Office 365 cloud app makes it possible to target services all at once. Microsoft recommend using the new Office 365 cloud app, instead of targeting individual cloud apps to avoid issues with service dependencies.

If you are unsure whether users are being prompted for MFA, I suggest reading my previous post.

Ensure multifactor authentication is enabled for all users in administrative roles

To enable MFA for administrative roles, create a Conditional Access from the template library. Run your policies in report-only mode to see the impact.

Ensure security defaults is disabled on Azure Active Directory

Tenants created before October 2019 do not have Security Defaults enabled default. If you disable Security Defaults, ensure Conditional Access is in place so that your tenant is not exposed. Here, you can verify if Security Defaults is enabled.

The new security defaults will help protect enterprise user accounts from password spray and phishing attacks by:

Requiring all users and admins to register for MFA using the Microsoft Authenticator app.
Challenging users with MFA, mostly when they show up on a new device or app, but more often for critical roles and tasks.
Disabling authentication from legacy authentication clients that can't do MFA.
Protecting admins by requiring extra authentication every time they sign in.

Ensure self-service password reset is enabled

Self-service password reset (SSPR) in Azure Active Directory (Azure AD) enables users to change or reset their password without administrator or help desk assistance. If Azure AD locks a user's account or they forget their password, they can unblock themselves and resume work by following on-screen instructions.

Recommend setting it to Selected if disabled ⚠️

Ensure that Office 365 passwords are not set to expire

Current research indicates that mandated password changes are counterproductive. They encourage users to select weaker passwords, reuse passwords, or update old passwords in a manner that is easily guessed by hackers.

Go to https://go.microsoft.com/fwlink/p/?linkid=2072756
Find Password expiration policy

Ensure that password hash sync is enabled for resiliency and leaked credential detection

Synchronization of the password hash is one of the sign-in methods used to achieve hybrid identity. Azure AD Connect synchronizes a user's password hash from an on-premises Active Directory tenant to an Azure AD tenant in the cloud.

You are able to check if Password hash sync is enabled by connecting to your AD Connect or by Azure AD.