Coverage
Check catalogue
Every check Basewiser runs today, and what each one stands on. 70 checks across Entra ID and Azure: 49 grounded in a public baseline (EIDSCA, CISA SCuBA or the Microsoft cloud security benchmark) and 21 that are Basewiser’s own, marked as such. Security findings carry the NIS2 Article 21(2) item they support.
Catalogue v1, 29 September 2026
How to read it. Each check shows the id the product uses, the worst severity a finding of it can reach, and its grounding. "Grounded in" names the public control ids behind the check. "Basewiser check" means no public baseline covers it and the judgement is ours. The NIS2 line says which Article 21(2) item a finding supports. It is not a compliance verdict, and nothing here scores a tenant.
Entra ID
46 checks
Identity, privileged access, MFA coverage, applications, tenant settings and Conditional Access hygiene.
Applications
high
Expiring app credentials
app-credential-expiry
Grounded in SCuBA MS.AAD.5.6v1, MS.AAD.5.7v1; MCSB v1 IM-3
supports Art. 21(2)(e): secure systems & maintenance
high
Insecure redirect URIs
app-insecure-redirect-uri
Basewiser check (no public baseline covers it)
supports Art. 21(2)(e): secure systems & maintenance
high
Over-privileged applications
app-risky-permissions
Basewiser check (no public baseline covers it)
supports Art. 21(2)(d): supply-chain security
high
Risky consent grants
app-consent-risk
Basewiser check (no public baseline covers it)
supports Art. 21(2)(d): supply-chain security
high
New credential on a privileged app
app-new-credential
Basewiser check (no public baseline covers it)
supports Art. 21(2)(i): access control
medium
Deprecated OAuth flows enabled
app-legacy-auth
Basewiser check (no public baseline covers it)
supports Art. 21(2)(e): secure systems & maintenance
medium
Unverified publisher, privileged app
app-unverified-publisher
Basewiser check (no public baseline covers it)
supports Art. 21(2)(d): supply-chain security
medium
Stale applications
app-stale
Basewiser check (no public baseline covers it)
supports Art. 21(2)(i): access control
Privileged access
high
Global Administrators
global-admin-inventory
Grounded in SCuBA MS.AAD.7.1v1, MS.AAD.7.4v1; MCSB v1 PA-1, PA-2
supports Art. 21(2)(i): access control
high
Tier-0 administrative roles
tier0-admin-inventory
Grounded in SCuBA MS.AAD.7.4v1; MCSB v1 PA-2, PA-7
supports Art. 21(2)(i): access control
high
Other privileged roles
privileged-role-inventory
Grounded in SCuBA MS.AAD.7.4v1, MS.AAD.7.2v1; MCSB v1 PA-2, PA-7
supports Art. 21(2)(i): access control
high
Service principals with privileged roles
sp-with-privileged-role
Basewiser check (no public baseline covers it)
supports Art. 21(2)(i): access control
medium
Privileged roles added in the last 30 days
recently-added-privileged
Grounded in SCuBA MS.AAD.7.7v1; MCSB v1 PA-4
supports Art. 21(2)(i): access control
high
Privileged users inactive 30+ days
privileged-user-stale-signin
Grounded in MCSB v1 PA-4
supports Art. 21(2)(i): access control
high
No break-glass account declared
no-break-glass-account
Grounded in MCSB v1 PA-5
supports Art. 21(2)(c): continuity & backups
medium
Break-glass validation overdue
break-glass-validation-overdue
Grounded in MCSB v1 PA-5
supports Art. 21(2)(c): continuity & backups
medium
Break-glass validation not recorded
break-glass-validation-unrecorded
Grounded in MCSB v1 PA-5
supports Art. 21(2)(c): continuity & backups
low
Break-glass sign-in history
break-glass-account-activity
Grounded in MCSB v1 PA-5
supports Art. 21(2)(i): access control
high
Guests holding privileged roles
guest-with-privileged-role
Basewiser check (no public baseline covers it)
supports Art. 21(2)(i): access control
high
AD-synced accounts holding privileged roles
hybrid-synced-privileged
Grounded in SCuBA MS.AAD.7.3v1; MCSB v1 PA-1
supports Art. 21(2)(i): access control
Group hygiene
high
Role-assignable groups
role-assignable-group-inventory
Basewiser check (no public baseline covers it)
supports Art. 21(2)(i): access control
high
Empty groups with privileged roles
empty-group-with-privileged-role
Basewiser check (no public baseline covers it)
supports Art. 21(2)(i): access control
Multi-factor authentication
critical
Admins without MFA
privileged-no-mfa
Grounded in SCuBA MS.AAD.3.2v2, MS.AAD.3.6v1; MCSB v1 IM-6
supports Art. 21(2)(j): multi-factor authentication
high
Admins with weak MFA
privileged-weak-mfa
Grounded in SCuBA MS.AAD.3.5v2, MS.AAD.3.6v1; MCSB v1 IM-6
supports Art. 21(2)(j): multi-factor authentication
high
Admins without phishing-resistant MFA
privileged-without-phishing-resistant-mfa
Grounded in SCuBA MS.AAD.3.6v1; MCSB v1 IM-6
supports Art. 21(2)(j): multi-factor authentication
medium
Users without MFA
non-privileged-no-mfa
Grounded in SCuBA MS.AAD.3.2v2; MCSB v1 IM-6
supports Art. 21(2)(j): multi-factor authentication
high
No policy enforces MFA on admin sign-ins
ca-policy-missing-mfa-on-admins
Grounded in SCuBA MS.AAD.3.6v1, MS.AAD.3.2v2; MCSB v1 IM-7
supports Art. 21(2)(j): multi-factor authentication
Stale identities
medium
Stale users
stale-user-90d
Grounded in MCSB v1 PA-4
supports Art. 21(2)(i): access control
medium
Stale guest accounts
stale-guest-90d
Grounded in MCSB v1 PA-4
supports Art. 21(2)(i): access control
low
Disabled accounts still licensed
disabled-still-licensed
Basewiser check (no public baseline covers it)
low
Guest invitations never accepted
pending-invite-stale
Basewiser check (no public baseline covers it)
supports Art. 21(2)(i): access control
Auth weakness
high
Legacy authentication not blocked
legacy-auth-allowed
Grounded in SCuBA MS.AAD.1.1v1; MCSB v1 IM-7, IM-2
supports Art. 21(2)(j): multi-factor authentication
medium
No risk-based Conditional Access
no-risk-based-ca
Grounded in SCuBA MS.AAD.2.1v1, MS.AAD.2.3v1; MCSB v1 IM-2, IM-7
supports Art. 21(2)(j): multi-factor authentication
high
Administrators can reset their own passwords
sspr-disabled
Grounded in EIDSCA.AP01
supports Art. 21(2)(i): access control
Risky users
critical
Users flagged at risk
risky-users
Grounded in MCSB v1 IM-2
supports Art. 21(2)(b): incident detection
surfaced via Microsoft Identity Protection
critical
Break-glass account used
break-glass-suspicious-activity
Grounded in MCSB v1 PA-5
supports Art. 21(2)(b): incident detection
Tenant settings
high
User consent allowed for all apps
user-consent-unrestricted
Grounded in EIDSCA.AP08; SCuBA MS.AAD.5.2v1; MCSB v1 IM-2
supports Art. 21(2)(d): supply-chain security
medium
Anyone can invite guests
guest-invites-unrestricted
Grounded in EIDSCA.AP04; SCuBA MS.AAD.8.2v1
supports Art. 21(2)(i): access control
medium
Users can register applications
users-can-register-apps
Grounded in EIDSCA.AP10; SCuBA MS.AAD.5.1v1
supports Art. 21(2)(i): access control
critical
No Conditional Access and no security defaults
no-ca-no-security-defaults
Basewiser check (no public baseline covers it)
supports Art. 21(2)(i),(j): access control & MFA
Policy hygiene
medium
No policy uses a location condition
ca-geo-restriction
Grounded in MCSB v1 IM-7
supports Art. 21(2)(i): access control
medium
Device compliance not required for sensitive actions
ca-device-compliance
Grounded in SCuBA MS.AAD.3.7v1; MCSB v1 IM-7
supports Art. 21(2)(i): access control
high
Policies stuck in Report-only mode
ca-report-only-stuck
Basewiser check (no public baseline covers it)
supports Art. 21(2)(i): access control
medium
Conflicting policy scopes
ca-conflicting-scopes
Basewiser check (no public baseline covers it)
supports Art. 21(2)(i): access control
medium
Country lists not enforced by any policy
named-location-country-unenforced
Basewiser check (no public baseline covers it)
supports Art. 21(2)(i): access control
low
Named locations unused
named-location-unused
Basewiser check (no public baseline covers it)
supports Art. 21(2)(g): cyber hygiene
Azure
24 checks
The subscriptions under management: public exposure, encryption, RBAC, Defender coverage, logging and idle spend.
Public exposure
high
Storage accounts allow public blob access
storage-public-blob-access
Grounded in MCSB v1 NS-2
supports Art. 21(2)(e): secure systems & maintenance
high
Storage accounts accept traffic from all networks
storage-network-default-allow
Grounded in MCSB v1 NS-2
supports Art. 21(2)(e): secure systems & maintenance
high
SQL servers reachable over the public endpoint
sql-public-network-access
Grounded in MCSB v1 NS-2
supports Art. 21(2)(e): secure systems & maintenance
high
Key Vaults reachable from all networks
keyvault-public-network-access
Grounded in MCSB v1 NS-2
supports Art. 21(2)(e): secure systems & maintenance
high
Network security groups expose management ports to the internet
nsg-open-management-port
Grounded in MCSB v1 NS-1, NS-7
supports Art. 21(2)(e): secure systems & maintenance
Encryption & transport
high
Storage accounts accept unencrypted HTTP traffic
storage-https-only
Grounded in MCSB v1 DP-3
supports Art. 21(2)(h): cryptography & encryption
medium
Storage accounts accept TLS below 1.2
storage-min-tls-version
Grounded in MCSB v1 DP-3
supports Art. 21(2)(h): cryptography & encryption
medium
App Service sites serve traffic over plain HTTP
appservice-https-only
Grounded in MCSB v1 DP-3
supports Art. 21(2)(h): cryptography & encryption
medium
Key Vaults can be permanently purged before the retention window ends
keyvault-purge-protection-disabled
Grounded in MCSB v1 DP-8
supports Art. 21(2)(h): cryptography & encryption
RBAC hygiene
high
Users and groups hold standing Owner access
rbac-owner-standing-access
Grounded in MCSB v1 PA-1, PA-2
supports Art. 21(2)(i): access control
high
Custom roles grant subscription-administrator permissions
rbac-custom-admin-role
Grounded in MCSB v1 PA-1, PA-7
supports Art. 21(2)(i): access control
high
Users and groups can grant themselves any access
rbac-user-access-administrator
Grounded in MCSB v1 PA-1
supports Art. 21(2)(i): access control
high
Service principals hold privileged roles over the whole subscription
rbac-serviceprincipal-privileged
Grounded in MCSB v1 PA-1
supports Art. 21(2)(i): access control
medium
Users hold standing Contributor access
rbac-contributor-standing-access
Grounded in MCSB v1 PA-2, PA-7
supports Art. 21(2)(i): access control
medium
Key Vaults still use legacy access policies
keyvault-legacy-access-policies
Grounded in MCSB v1 PA-7
supports Art. 21(2)(i): access control
low
Role assignments made below the subscription
rbac-assignments-below-subscription
Grounded in MCSB v1 PA-7
supports Art. 21(2)(i): access control
Defender
medium
Defender plans configured inconsistently across subscriptions
defender-plan-drift
Grounded in MCSB v1 LT-1
supports Art. 21(2)(b): incident detection
low
No paid Defender for Cloud plan is enabled on any subscription
defender-no-plans-enabled
Grounded in MCSB v1 LT-1
supports Art. 21(2)(b): incident detection
Logging & audit
medium
No activity-log alert on policy, network or SQL firewall changes
logging-no-activity-alert-critical-change
Grounded in MCSB v1 LT-3, LT-5
supports Art. 21(2)(b): incident detection
low
Regions hold virtual networks but have no Network Watcher
logging-no-network-watcher
Grounded in MCSB v1 LT-4
supports Art. 21(2)(b): incident detection
low
Log Analytics workspaces keep logs for less than 90 days
logging-workspace-short-retention
Grounded in MCSB v1 LT-6
supports Art. 21(2)(b): incident detection
Waste
low
Public IP addresses reserved but not attached to anything
publicip-unassociated
Basewiser check (no public baseline covers it)
low
Virtual machines are stopped but still billing
vm-stopped-not-deallocated
Basewiser check (no public baseline covers it)
low
App Service plans host no sites
appserviceplan-empty
Basewiser check (no public baseline covers it)
Planned
The coverage areas being built next, named at area level. No ids and no dates until a check ships. When one does, it appears above and the catalogue version moves.
Mail authentication
SPF, DKIM, DMARC and MTA-STS read from public DNS, so a domain's mail posture is visible without touching the tenant. Graded against the CISA SCuBA Exchange Online baseline.
Wider Entra and Microsoft 365 settings
The remaining Entra tenant settings on the app-only Graph lane, the full EIDSCA set, SharePoint and OneDrive sharing settings, and a first Teams subset. Graded against EIDSCA and the SCuBA baselines for each service.
Exchange Online and Defender for Office
The Exchange administrative surface (transport rules, mailbox auditing, forwarding), with the Defender for Office anti-phishing, Safe Links and Safe Attachments policies beside it. Graded against the SCuBA Exchange Online and Defender baselines.
Basewiser also watches connected tenants in near real time and raises alerts as things happen: a privileged role granted, a Conditional Access policy changed or deleted, a user added to a Conditional Access exclusion. Those alerts are not part of this catalogue.
How the product is built and operated is on the compliance page. Questions about a specific check, or one you need that is not here? contact@basewiser.com.