# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-AUDIT-013
title: Review Secure Score and Entra recommendations periodically
finding:
  title: Microsoft security recommendations for the tenant are not reviewed
  description: New weaknesses reported by Microsoft Secure Score and Microsoft Entra recommendations accumulate unnoticed between audits.
status: active
profiles: [hardened]
risk:
  severity: low
assessment: manual
tags: [posture-management, secure-score, recommendations, governance]

description: |
  At least every **{{ posture_review_interval_days }}** days, the security team reviews Microsoft
  Secure Score (Microsoft Defender portal) and Microsoft Entra recommendations. Each open
  recommendation is either remediated, planned with an owner and a date, or accepted as a risk with
  a recorded justification (status **Risk accepted** or **Planned** in Secure Score, **Dismissed**
  or **Postponed** with a reason in Entra). The score trend and decisions are reported to the
  security officer.
rationale: |
  Microsoft adds checks as the platform changes (new features, new attack techniques). A baseline
  applied once drifts: settings are changed, new workloads arrive. A regular review of the vendor's
  own recommendations is a cheap way to catch drift between full audits and to keep exceptions
  documented.
impact: |
  A few hours of work per review. Some Entra recommendations require Entra ID P2 to be displayed.

parameters:
  - name: posture_review_interval_days
    type: integer
    description: Maximum number of days between two reviews of Secure Score and Entra recommendations.
    unit: days
    default: 30
    minimum: 7
    maximum: 90

audit:
  manual: |
    1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a
       Security Reader, browse to **Exposure management** > **Secure Score** (or **Secure Score**) >
       **Recommended actions**, and check that open actions have a status other than **To address**
       or a recent history entry.
    2. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global
       Reader, browse to **Entra ID** > **Overview** > **Recommendations**, and check that active
       recommendations are being handled or dismissed with a reason.
    3. Graph alternative (read only): `GET https://graph.microsoft.com/v1.0/security/secureScores?$top=1`
       and `GET https://graph.microsoft.com/beta/directory/recommendations`.
    4. Ask for the last review record (minutes, ticket, report).
    5. Fail if no review took place in the last {{ posture_review_interval_days }} days, or if
       high-impact recommendations stay **To address** without owner or decision.

remediation:
  manual: |
    1. Schedule a recurring review every {{ posture_review_interval_days }} days with an owner in the
       security team.
    2. During each review, process every new or open recommendation: remediate, plan with an owner,
       or set **Risk accepted** with a justification in Secure Score and dismiss with a reason in
       Entra recommendations.
    3. Record the score trend and decisions, and report them to the security officer.
    4. Roles required to change statuses: Security Administrator (Secure Score), Security
       Administrator or Global Administrator (Entra recommendations).
  rollback: |
    Not applicable.

references:
  - title: Microsoft Secure Score
    url: https://learn.microsoft.com/defender-xdr/microsoft-secure-score
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: What are Microsoft Entra recommendations
    url: https://learn.microsoft.com/entra/identity/monitoring-health/overview-recommendations
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Maester MT.1024
    url: https://maester.dev/docs/tests/
    publisher: Maester
    kind: tool
    accessed: 2026-10-24
mappings:
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: CA-7
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: CM-6
    relation: related
related_controls:
  - id: CB-M365-AUDIT-011
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24