CIS Microsoft 365 Foundations Benchmark v7.0.0: What Changed and How It Changes an Audit

The short version: The CIS Microsoft 365 Foundations Benchmark is the published checklist most independent tenant audits measure against. Version 7.0.0 was released in May 2026, and Brocent's one-off Microsoft 365 security audit measures it at Level 1 and Level 2; the published sample assessed 118 controls. This article explains what the benchmark is, what changed, how to read a pass rate, and which question to ask any provider before you buy.

If you have been quoted a tenant review and the proposal says "measured against the CIS Microsoft 365 Foundations Benchmark v7", this is the article that tells you what that sentence commits the provider to. The benchmark is a long document written for administrators, and most of the buyer-facing explanations either skip the detail or assume you already run a security team. This one is written for the owner, finance lead or IT manager of a small or mid-sized company who has to decide whether an audit is worth paying for and how to judge the report that comes back.

Everything below about Brocent's own audit refers to the published sample report, which uses a fictitious 14-person firm, and to the Microsoft 365 Security Audit pricing page. Nothing here is a client's data.

What is the CIS Microsoft 365 Foundations Benchmark?

The Center for Internet Security (CIS) publishes configuration benchmarks for operating systems, cloud platforms and applications. The Microsoft 365 Foundations Benchmark is the one for a Microsoft 365 tenant: Entra ID, Exchange Online, SharePoint and OneDrive, Teams, Defender, Purview and the Intune admin centre. Each recommendation names a setting, states the value it should have, explains why, and gives the steps to check and to fix it.

Three things make it useful as an audit yardstick rather than just a hardening guide:

• It is independent of Microsoft. Secure Score is Microsoft's own view of your tenant and it is weighted towards features Microsoft licenses. The CIS Benchmark is maintained by a community of practitioners and does not change when a licence bundle changes.
• It is versioned. Every recommendation has a stable identifier and the whole document carries a version number, so two audits of the same tenant a year apart can be compared control by control.
• It separates automated from manual controls. Some settings can be read by a script; others need a person to look at a list of administrators, a Conditional Access policy or a sharing setting and make a judgement. The benchmark labels each one, which is how an audit report can be honest about what was verified and what was reviewed.

If you want the wider comparison of how Secure Score, the CIS Benchmark and CISA's ScubaGear differ, we wrote it up separately in Secure Score vs CIS Benchmark vs ScubaGear. This article stays with the benchmark itself.

What is the difference between Level 1 and Level 2?

Every recommendation in the benchmark is assigned a profile level.

• Level 1 is the baseline. These are settings that reduce risk without a meaningful effect on how people work: block legacy authentication, require MFA for administrators, turn on the unified audit log, stop anonymous sharing links from lasting forever. A small business should expect to pass almost all of Level 1 once the basics are done.
• Level 2 is defence in depth. These settings add protection but may cost something in convenience or need a higher licence: phishing-resistant authentication for privileged roles, stricter Conditional Access, Purview data loss prevention policies, tighter external sharing. Some Level 2 items are only possible on Business Premium, E3 or E5.

Why does it matter which level an audit covers? Because a report that only measures Level 1 can look excellent while the tenant still has every Level 2 gap an attacker would use after the first password is phished. The sample report measures both levels and marks the licence profile each control applies to, so a Business Premium tenant is not failed on an E5-only control. When a provider quotes "CIS-aligned", ask whether that means Level 1 only.

What changed in version 7.0.0?

CIS released version 7.0.0 of the Microsoft 365 Foundations Benchmark in May 2026; the release is listed in CIS's June 2026 benchmarks update, which our [Kent audit article] cites, see (/blog/posts/microsoft-365-security-audit-kent-uk-south-east).

• A new identifier scheme. The only public summary we have read, reported in our Secure Score vs CIS vs ScubaGear article, counts 21 new recommendations, around 55 updated and a renumbering of the rest; we have not verified those counts against CIS's own change log. Renumbering is why a finding written against v6 cannot simply be looked up by its old number in a v7 report. Any provider comparing your new report with an older one has to map the identifiers, and a good report says so.
• What we can see in the sample itself. The v7.0.0 report groups controls into nine sections, including Purview, Intune and Fabric alongside Entra, Exchange, SharePoint, Teams and Defender. We have not read CIS's change log, so this article makes no claim about what v6 did or did not cover, which guidance was rewritten, or which controls were retired; read the change log that ships with the benchmark document for that.

The practical effect for a buyer is simple. A report dated 2026 that still cites version 6 was measured against a checklist that no longer matches Microsoft's admin centres. Ask for the version in writing.

How does an audit use the benchmark?

An audit is not the benchmark read aloud. The benchmark gives the auditor the list of settings and the target value for each; the audit adds four things.

1. A read-only pull of the actual configuration. Brocent's audit uses a Microsoft Graph application that your Global Administrator consents to once. It reads settings and reports; it does not read the content of mail or files, and it can be removed in Entra afterwards.
2. Automated checks where a setting can be read by machine. These produce a pass or fail with the evidence attached: the policy export, the report row, the date it was pulled.
3. Manual review where the benchmark says a person has to judge. Who holds Global Administrator and whether they still need it. Whether the emergency access account is really protected. Whether a Conditional Access policy that looks right has an exclusion group that quietly covers half the company. These are the findings that scanners cannot produce and that the sample report marks as "manual" rather than inventing a pass.
4. Severity, effort and order. The benchmark does not tell you which of thirty failures to fix first. The report does, with a phased plan.

The Microsoft 365 security audit checklist walks through the twelve areas in the order the report presents them, if you want to self-check before commissioning anything.

How do you read a section-by-section pass rate?

The sample report summarises the benchmark results in one table before the detailed findings. Using its figures, 118 controls were assessed: 72 pass, 31 fail, 9 need manual review and 6 are not applicable. The pass rate is pass divided by pass plus fail plus manual, so not-applicable controls neither help nor hurt. The sections in that sample read as follows.

• §1 Microsoft 365 admin center: 9 pass, 3 fail, 1 manual, 69%. Mostly tenant-wide hygiene such as unused licences and self-service purchasing.
• §2 Microsoft Defender: 13 pass, 4 fail, 1 manual, 72%. Anti-phishing, Safe Links and Safe Attachments policies, and whether preset policies were ever switched from the defaults.
• §3 Microsoft Purview: 4 pass, 5 fail, 1 manual, 40%. The lowest section in the sample: audit log retention, DLP and sensitivity labels are the controls small tenants most often never touch.
• §4 Microsoft Intune admin center: 2 pass, 2 fail, 50%. Device compliance is a thin section here because device posture is the separate Intune device audit.
• §5 Microsoft Entra admin center: 19 pass, 9 fail, 2 manual, 1 not applicable, 63%. The largest section and the one holding two of the sample's three critical findings: a Global Administrator break-glass account excluded from MFA (F-01) and legacy authentication left in report-only (F-03); the permanently assigned administrators (F-04) are a high finding.
• §6 Exchange admin center: 12 pass, 4 fail, 1 manual, 71%. Mail flow, forwarding, SMTP AUTH and mailbox auditing.
• §7 SharePoint admin center: 7 pass, 3 fail, 2 manual, 58%. External sharing defaults and anyone links.
• §8 Microsoft Teams admin center: 6 pass, 1 fail, 1 manual, 1 not applicable, 75%. External access and meeting policies.
• §9 Microsoft Fabric (Power BI): 3 not applicable. The sample firm does not use it, so the section is reported as not applicable rather than counted as a pass.

Three reading rules follow from that table. First, the overall 64% (the report's headline tile shows 61%, which keeps not-applicable controls in the denominator) matters less than the shape: a low Purview score in a firm that handles client identity documents is a different problem from a low Fabric score in a firm that does not use Fabric. Second, "manual" is not a soft fail; it means a person looked and recorded what they saw, and the detailed finding tells you what they concluded. Third, a section with few controls can swing wildly on one change, so compare counts, not just percentages, between two audits.

Which question should you ask a provider before you buy?

One question does most of the work: which version of the CIS Microsoft 365 Foundations Benchmark will the report be measured against, and will it state the version on the cover? If the answer is "the latest" without a number, press for the number. If the answer is version 6 in late 2026, ask why. If the answer is version 7.0.0, ask whether both Level 1 and Level 2 are in scope and how manual controls will be reported.

The other questions are the ones every audit buyer should ask regardless of benchmark: how access is granted and removed, what the report contains, how long it takes and what it costs. Brocent's answers are published: a read-only Graph application, a report and workbook designed to be used as evidence, 5 to 7 business days after consent, and a fixed price by headcount from US$450 for 1 to 10 users to US$2,900 for 76 to 150 users, with larger tenants quoted. The explainer What is a Microsoft 365 security audit? covers the process end to end.

Secure Score, CIS Level 1 or CIS Level 2: which measure do you need?

• Microsoft Secure Score: built into the tenant, updates continuously, good for watching a trend. It only sees what Microsoft's API exposes and it scores against Microsoft's recommendations, so it cannot see a manual control and it tends to reward licensed features.
• CIS Level 1: the independent baseline. Right for a tenant that has never been reviewed and wants a defensible list of basics with evidence. A high Level 1 score with a low Level 2 score is a common and honest result for a small business.
• CIS Level 2: the full picture, including the controls an insurer or a larger client's questionnaire tends to ask about. Right for regulated firms, firms renewing cyber insurance, and any tenant that has already closed its Level 1 gaps.

Brocent's one-off audit measures Level 1 and Level 2 together and reports Secure Score alongside, so you get all three numbers from one engagement rather than having to reconcile them yourself.

Frequently asked questions

Is the CIS Microsoft 365 Foundations Benchmark free to read?

Yes. CIS publishes the benchmark document free of charge after registration on its website. What costs money is the time to check 118 controls against your tenant, judge the manual ones and write it up with evidence, which is what an audit sells.

Does passing the CIS Benchmark make us compliant with anything?

No, and a report should never say so. The benchmark is a configuration standard, not a law or a certification scheme. An audit report measured against it is designed to be used as evidence when you answer an insurer, a client questionnaire or a Cyber Essentials assessor; it does not certify, satisfy or guarantee any of them.

Which CIS version does Brocent's audit use?

Version 7.0.0 of the CIS Microsoft 365 Foundations Benchmark, stated on the cover of the sample report; the results table gives the 118-control count. When CIS publishes a new version, the report states the version it was measured against so two reports can be compared honestly.

We were audited against version 6 last year. Can the results be compared?

Partly. Because v7.0.0 renumbered recommendations, the comparison has to be done control by control rather than by identifier, and a few controls were retired or added. A provider who re-audits you should supply that mapping rather than leave you to work it out.

Do we need Level 2 if we only have Business Premium?

Many Level 2 controls are available on Business Premium, which includes Entra ID P1, Intune and Defender for Business. The report marks the licence profile for each control, so Level 2 controls that genuinely need E5 are shown as not applicable rather than failed.

How long does the audit take, and what does it cost?

The report arrives 5 to 7 business days after your Global Administrator consents to the read-only application. The price is fixed by headcount: US$450 for 1 to 10 users, US$990 for 11 to 25, US$1,800 for 26 to 75 and US$2,900 for 76 to 150; tenants above 150 users are quoted.

Can a scanner do this instead of an audit?

A scanner can check the automated controls and produce a pass or fail list in minutes. It cannot judge the manual controls, decide what to fix first, or explain a finding to a non-technical owner. In the sample report, nine controls needed manual review, and the top finding (F-01) turned on reading the membership of an exclusion group, the kind of judgement a pass/fail scanner does not make.

Next steps

If you want to see how a v7.0.0 result is presented before you commit to anything, read the sample Microsoft 365 security audit report online; the PDF and Excel workbook follow a short form. The scope and the fixed price by headcount are on the audit pricing page, and if you would like a quote for your tenant, talk to a consultant.