Microsoft 365 Enterprise Security Baseline Kit

This repository contains an enterprise-grade security baseline toolkit for hardening and auditing Microsoft 365, Microsoft Entra ID (Azure AD), Microsoft Intune, and Microsoft Purview environments.

It provides:

1. Infrastructure as Code (IaC) using Terraform to deploy Microsoft Entra Conditional Access policies.
2. Automated Scripts using PowerShell to configure Intune device compliance rules and Purview Data Loss Prevention (DLP) controls.
3. A Compliance Auditing Utility written in Python to scan tenant settings and generate responsive, interactive HTML dashboards and reports.

---

Architecture Overview

The baseline establishes a zero-trust verification model that evaluates identity, device health, and data exfiltration paths before and during access.

For detailed architecture diagrams and security flow charts, see the Architecture Documentation and Compliance Mapping Matrix.

---

Enterprise Case Study & Production Impact

This security baseline toolkit was deployed in a production corporate tenant of over 5,000+ users to harden the cloud identity boundary and ensure managed endpoints conform to CIS benchmarks.

Key Deployment Achievements

• 100% MFA Enrollment: Deployed phased Conditional Access policies coupled with Entra ID registration campaign rules, achieving full MFA adoption for all administrative and user accounts.
• 98% Device Compliance: Configured automated Intune compliance baseline rules (Secure Boot, BitLocker, Firewall, and AV). Restricted resource access only to compliant workstations, bringing managed endpoints up to a 98% compliance state.
• 40% Security Incident Reduction: Mitigated unmanaged personal device logins, blocked legacy authentication protocols, and established Microsoft Purview DLP rules, successfully reducing overall security incidents (credential compromise, unauthorized sharing) by 40%.

---

Directory Structure

.
├── .github/workflows/ci.yml    # Continuous Integration pipeline (Pytest & TF check)
├── docs/                       # High-level design and mapping guides
│   ├── architecture.md         # Mermaid system architecture diagrams
│   └── policies_matrix.md      # Security framework compliance matrix (CIS, NIST, ISO)
├── terraform/                  # Infrastructure as Code for Entra ID CA Policies
│   ├── main.tf                 # Principal resources (excluding group, admin roles, and rules)
│   ├── variables.tf            # Configurable inputs (fully sanitized)
│   ├── outputs.tf              # Created resource exports
│   └── policies/               # JSON policies backup for direct import/export
├── powershell/                 # Automated deployment scripts for M365 Services
│   ├── Deploy-IntunePolicies.ps1  # Automated Intune compliance deployment
│   ├── Deploy-PurviewDLP.ps1   # Automated Purview DLP rules setup
│   └── policies/               # JSON schemas defining baseline requirements
├── scanner/                    # M365 Security Compliance Audit tool (Python)
│   ├── auth.py                 # MSAL OAuth2 Authentication handler
│   ├── checker.py              # Tenant configuration auditing logic
│   ├── reporter.py             # Generates HTML dashboards & markdown reports
│   ├── main.py                 # CLI entry point
│   └── tests/                  # Mock-based unit testing suite
├── .gitignore                  # Sanitized rules preventing private files commit
├── .env.example                # Shell file for environment variables
├── requirements.txt            # Python dependencies
├── setup.py                    # Scanner package installer
└── README.md                   # This document

---

Getting Started: Compliance Scanner

The Python scanner executes a series of REST requests using the Microsoft Graph API. It audits the tenant against the established baselines and generates compliance dashboards.

1. Installation

Clone the repository and install the dependencies:

git clone https://github.com/bluespam-cyber/m365-security-baseline.git
cd m365-security-baseline
pip install -r requirements.txt
pip install -e .

2. Run in Demo Mode (Out of the Box)

Verify scanner execution and view report formats instantly without configuring Microsoft Azure AD credentials:

python -m scanner.main --demo

This runs the checker using simulated tenant payloads, writing scanner_report.html and scanner_report.md in your directory.

3. Run Against a Live Tenant

To scan a live tenant, register an application in your Microsoft Entra ID portal with the following permissions:

• Policy.Read.All
• DeviceManagementConfiguration.Read.All
• Directory.Read.All

Copy .env.example to .env and fill in your app coordinates:

cp .env.example .env

Update .env with your values:

M365_TENANT_ID="your-tenant-guid"
M365_CLIENT_ID="your-application-client-guid"
M365_CLIENT_SECRET="your-client-secret-string"

Run the scanner:

python -m scanner.main

---

Deployment: Baseline Policies

1. Entra ID Conditional Access (Terraform)

Deploy Conditional Access policies to block legacy protocols, require MFA for directory admins, and restrict access to compliant machines.

1. Configure authentication variables or use az login.
2. Navigate to the terraform directory:

   cd terraform

3. Initialize and deploy:

   terraform init
   terraform plan -out=tfplan
   terraform apply tfplan

Note: Policies are provisioned in Report-Only state. Review log activities in Azure Monitor before moving policies to Enabled state.

2. Intune Compliance Rules (PowerShell)

Deploy endpoint compliance policies mandating BitLocker encryption, Secure Boot, Firewall status, and Windows Defender protection.

Run the script from an elevated PowerShell console:

cd powershell
.\Deploy-IntunePolicies.ps1 -TenantId "your-tenant-guid" -ClientId "your-app-client-guid" -ClientSecret "your-client-secret"

3. Purview Data Loss Prevention (PowerShell)

Create Purview rules blocking external sharing of U.S. SSNs, Credit Cards, and Passports across Exchange, Teams, OneDrive, and SharePoint.

Ensure the ExchangeOnlineManagement module is installed and execute the deployment script:

cd powershell
.\Deploy-PurviewDLP.ps1 -TenantId "your-tenant-name.onmicrosoft.com"

(Prompts for credentials if interactive authentication is utilized).

---

Security Framework Alignment

The baseline is mapped to:

• CIS Microsoft 365 Foundations Benchmark v3.0 (Level 1 & Level 2)
• NIST SP 800-53 Rev. 5 (AC-2, AC-17, IA-2, CM-6, SC-28)
• ISO/IEC 27001:2022 (A.5.15, A.8.5, A.8.9, A.8.12, A.8.23)

---

Running Automated Tests

Run the test suite using pytest to verify auditing configurations:

pytest scanner/tests/

---

Sanitization Policy

This repository is strictly sanitized. No personal tenant identifiers, secret tokens, private emails, or certificates are included in the source files.