{
  "id": "CB-M365-AUDIT-013",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-013",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-013.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-013.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUDIT-013",
    "title": "Review Secure Score and Entra recommendations periodically",
    "finding": {
      "title": "Microsoft security recommendations for the tenant are not reviewed",
      "description": "New weaknesses reported by Microsoft Secure Score and Microsoft Entra recommendations accumulate unnoticed between audits."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "posture-management",
      "secure-score",
      "recommendations",
      "governance"
    ],
    "description": "At least every **{{ posture_review_interval_days }}** days, the security team reviews Microsoft\nSecure Score (Microsoft Defender portal) and Microsoft Entra recommendations. Each open\nrecommendation is either remediated, planned with an owner and a date, or accepted as a risk with\na recorded justification (status **Risk accepted** or **Planned** in Secure Score, **Dismissed**\nor **Postponed** with a reason in Entra). The score trend and decisions are reported to the\nsecurity officer.\n",
    "rationale": "Microsoft adds checks as the platform changes (new features, new attack techniques). A baseline\napplied once drifts: settings are changed, new workloads arrive. A regular review of the vendor's\nown recommendations is a cheap way to catch drift between full audits and to keep exceptions\ndocumented.\n",
    "impact": "A few hours of work per review. Some Entra recommendations require Entra ID P2 to be displayed.\n",
    "parameters": [
      {
        "name": "posture_review_interval_days",
        "type": "integer",
        "description": "Maximum number of days between two reviews of Secure Score and Entra recommendations.",
        "unit": "days",
        "default": 30,
        "minimum": 7,
        "maximum": 90
      }
    ],
    "audit": {
      "manual": "1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a\n   Security Reader, browse to **Exposure management** > **Secure Score** (or **Secure Score**) >\n   **Recommended actions**, and check that open actions have a status other than **To address**\n   or a recent history entry.\n2. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global\n   Reader, browse to **Entra ID** > **Overview** > **Recommendations**, and check that active\n   recommendations are being handled or dismissed with a reason.\n3. Graph alternative (read only): `GET https://graph.microsoft.com/v1.0/security/secureScores?$top=1`\n   and `GET https://graph.microsoft.com/beta/directory/recommendations`.\n4. Ask for the last review record (minutes, ticket, report).\n5. Fail if no review took place in the last {{ posture_review_interval_days }} days, or if\n   high-impact recommendations stay **To address** without owner or decision.\n"
    },
    "remediation": {
      "manual": "1. Schedule a recurring review every {{ posture_review_interval_days }} days with an owner in the\n   security team.\n2. During each review, process every new or open recommendation: remediate, plan with an owner,\n   or set **Risk accepted** with a justification in Secure Score and dismiss with a reason in\n   Entra recommendations.\n3. Record the score trend and decisions, and report them to the security officer.\n4. Roles required to change statuses: Security Administrator (Secure Score), Security\n   Administrator or Global Administrator (Entra recommendations).\n",
      "rollback": "Not applicable.\n"
    },
    "references": [
      {
        "title": "Microsoft Secure Score",
        "url": "https://learn.microsoft.com/defender-xdr/microsoft-secure-score",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "What are Microsoft Entra recommendations",
        "url": "https://learn.microsoft.com/entra/identity/monitoring-health/overview-recommendations",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Maester MT.1024",
        "url": "https://maester.dev/docs/tests/",
        "publisher": "Maester",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CA-7",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-6",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUDIT-011",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}