Appendix A — Federal Requirements Crosswalk

Microsoft’s Entra security checklist scored for a federal agency with a long Active Directory history, crossed with the CISA BOD 25-01 required SCuBA policies, the identity modernization specification’s contract requirements, and NIST SP 800-53 Rev. 5 controls.

Appendix A — Federal Requirements Crosswalk

A baseline check is a ten-minute toggle in one tenant and a nine-month program in another; the difference is the Active Directory estate behind it.

NoteIn this appendix

Microsoft’s Entra security checklist and the three filters that decide what a federal agency can do with it. How to read the crosswalk, and a scored set of identity controls tied to the CISA BOD 25-01 required configurations. The contract requirements of the program’s identity modernization specification, and the NIST SP 800-53 Rev. 5 controls the identity work supports.

The assessment in one paragraph

An agency with twenty years of Active Directory behind its Entra ID tenant can put a meaningful part of Microsoft’s baseline in place quickly. The consent, guest, logging, emergency-access, legacy-authentication, and privileged-identity checks are mostly covered by licenses the agency already holds, and most are configuration only. Three filters then remove or defer a large share of the checklist before any work starts. Much of the “Protect networks” theme depends on Global Secure Access, which isn’t yet available in every government cloud. The AI theme is new, and its availability has to be confirmed cloud by cloud. And the heaviest identity checks (sign-in only from managed devices, token protection, phishing-resistant authentication for everyone, cloud authentication) are gated on device, device-management, and federation modernization that two decades of Active Directory turn into multi-quarter work. The agency’s structural advantage is the PIV/CAC card it already issues: Entra certificate-based authentication turns that card into a phishing-resistant credential without a federation server, which speeds up several of the hardest checks.1

The baseline

Microsoft publishes a checklist, “Configure Microsoft Entra for increased security,” that groups its Entra security recommendations into themes based on the Secure Future Initiative and lists a minimum license for each check. The page is labeled preview, covers workforce tenants, and says Microsoft will add controls over time.2 Its seven themes are:

  1. Protect identities and secrets
  2. Protect tenants and isolate production systems
  3. Protect networks
  4. Protect engineering systems
  5. Monitor and detect cyberthreats
  6. Accelerate response and remediation
  7. AI

Microsoft’s Zero Trust Assessment tool tests a tenant against these checks automatically, which is faster and less error-prone than checking by hand.3 The crosswalk below uses the checklist’s own check names so that results from the assessment tool can be joined to it directly. Because the checklist changes, an agency should re-pull it before each planning cycle rather than treating this appendix as the current list.

The three filters

Filter 1: government-cloud availability

Filter 1 — availability by theme
Theme What to expect
Protect identities and secrets Available. Two checks for private applications need Entra Internet Access or Private Access licenses, so they follow the network row.
Protect tenants and isolate production systems Available.
Protect networks Mixed. Named locations and Tenant restrictions v2 need only Entra ID P1. Most of the remaining checks need Microsoft Entra Internet Access or Private Access, part of Global Secure Access, which is available in GCC but not yet in GCC High, the Department of Defense cloud, or other sovereign clouds.4 Treat these as an evaluation, not a quick win.
Protect engineering systems Available.
Monitor and detect cyberthreats Available, except the network-access log checks, which follow Global Secure Access availability.
Accelerate response and remediation Available; needs Entra ID P2 or Microsoft Entra Workload ID, so confirm entitlement.5
AI New checks for agent identities. Confirm availability in the agency’s cloud before planning; defer otherwise.

The source material said the network theme was “gated or non-FIPS in government clouds.” Microsoft’s current limitation is narrower and more useful for planning: Global Secure Access runs in GCC, whose tenants use the commercial Entra ID service, and isn’t yet supported in GCC High or DoD.67 The FIPS claim couldn’t be verified and is dropped.

Filter 2: licensing

Each check in the checklist names a minimum license: none (included with Entra ID), Entra ID P1, Entra ID P2 or Microsoft Entra ID Governance, Entra Internet Access, Entra Private Access, the Microsoft Entra Suite, or Workload ID.8 Most identity, tenant, and engineering checks need P1 or P2, which many federal enterprise agreements already include. In the program’s experience the constraint for the majority of checks is operational, not entitlement. The exception is the network theme, where the Internet Access and Private Access licenses are separate purchases and run into Filter 1 as well.

Filter 3: Active Directory friction

The same check can be a ten-minute toggle or a nine-month program depending on the hybrid estate behind it: directory synchronization, federation through AD FS, applications that still use basic authentication, decades of service accounts, domain-joined devices, and password policy set by on-premises Group Policy. The friction column in the crosswalk names that entanglement and the effort tier prices it. Both are the program’s assessment, not Microsoft’s.

How to read the crosswalk

Government-cloud availability:

  • Available: works in the agency’s cloud today.
  • Caveated: works, with a license, preview, or feature limit noted.
  • Not available: not supported in the agency’s cloud yet.

Active Directory friction:

  • Cloud-only: no on-premises entanglement.
  • Hybrid-touching: needs coordination with sync, devices, or users.
  • Legacy-blocking: gated on retiring or modernizing a long-standing Active Directory dependency.

Effort tier:

  • T0, this week: a tenant setting with no legacy dependency.
  • T1, days: the setting is fast; discovery, coordination, and rollout are the work.
  • T2, weeks: inventory and remediation, or a staged rollout.
  • T3, multi-quarter: gated on device, identity, or federation modernization.

The crosswalk: identity controls

The first three columns come from Microsoft’s checklist.9 The SCuBA column gives the matching mandatory policy from the CISA BOD 25-01 required configurations, where one exists.10 The NIST column is the program’s mapping to SP 800-53 Rev. 5 controls; the control titles are in the last section. Friction and tier are the program’s assessment.

Identity controls scored for a long-standing Active Directory estate
Check (Microsoft name) Theme Minimum license Friction Tier SCuBA mandatory policy NIST SP 800-53 Rev. 5
User consent settings are restricted Identities None Cloud-only T0 MS.AAD.5.2v1 AC-6, CM-6
Admin consent workflow is enabled Identities None Cloud-only T0 MS.AAD.5.3v1 AC-6
Creating new applications and service principals is restricted to privileged users Engineering P1 Cloud-only T0 MS.AAD.5.1v1 AC-6, CM-7
Emergency access accounts are configured appropriately Engineering P1 Cloud-only T0 — AC-2
Diagnostic settings are configured for all Microsoft Entra logs Monitor P1 Cloud-only T0 — AU-2, AU-12
Guests can’t invite other guests Tenants Free Cloud-only T0 — IA-8, AC-2
Block legacy authentication policy is configured Identities P1 Legacy-blocking T1, report-only first MS.AAD.1.1v1 IA-2, AC-3
Restrict high risk sign-ins Response P2 Cloud-only T1 MS.AAD.2.3v1 SI-4, AC-3
Restrict access to high risk users Response P2 Cloud-only T1 MS.AAD.2.1v1 SI-4, AC-2
Password expiration is disabled Identities P1 Hybrid-touching T1 MS.AAD.6.1v1 IA-5(1)
Global Administrator role activation triggers an approval workflow Engineering P2 Cloud-only T1 MS.AAD.7.6v1 AC-6(5)
Privileged accounts have phishing-resistant methods registered Identities P1 Hybrid-touching; CBA accelerates T1 to T2 MS.AAD.3.6v1 IA-2(1), IA-2(8), IA-2(12)
All privileged role assignments are activated just in time and not permanently active Identities P2 Hybrid-touching T2 MS.AAD.7.4v1 AC-2(7), AC-6(5)
Privileged accounts are cloud native identities Identities None Legacy-blocking T2 to T3 MS.AAD.7.3v1 AC-2(7), AC-6(5)
All user sign-in activity uses phishing-resistant authentication methods Identities P1 Legacy-blocking; CBA accelerates T2 to T3 MS.AAD.3.1v1 IA-2(1), IA-2(2), IA-2(8), IA-2(12)
Use cloud authentication Identities P1 Legacy-blocking (federation migration) T3 — IA-2, IA-5
All sign-in activity comes from managed devices Identities P1 Legacy-blocking (device-management maturity) T3 — AC-3, IA-3
Token protection policies are configured Identities P1 Legacy-blocking (device-join maturity) T3 — SC-23, IA-3

Notes on the rows that the Active Directory estate changes most:

  • Password expiration is disabled. For users in scope of password hash synchronization, the cloud password is set to never expire by default, and the on-premises password policy still governs the password itself.11 Meeting the SCuBA policy for synced users means changing the on-premises policy too, which is why this row is hybrid-touching.
  • Use cloud authentication. Microsoft’s reasoning is that an on-premises federation server is a central point an attacker can use to forge tokens and pivot into the cloud; the remediation is migrating from federation to password hash synchronization or another cloud method.12 For a federated agency, that is a domain-by-domain migration, not a toggle.
  • Phishing-resistant authentication. OMB M-22-09 requires agency staff to use phishing-resistant multifactor authentication.13 SCuBA makes it mandatory for all users (MS.AAD.3.1v1), with an alternative MFA method required in the meantime (MS.AAD.3.2v1).14 Entra certificate-based authentication with PIV/CAC, FIDO2 security keys, and Windows Hello for Business are the qualifying methods Microsoft lists for M-22-09; Microsoft Authenticator alone isn’t phishing-resistant.15
  • The source’s control names. Several names in the source material were shortened (“All privileged role assignments are just-in-time”). The table uses Microsoft’s current wording so assessment output joins cleanly.

Sequencing

Start with the T0 and T1 cloud-only checks: consent, application registration, guests, emergency access, logging, risk policies, and legacy authentication in report-only mode. Several of these are also SCuBA mandatory policies, so they close BOD 25-01 findings at the same time. Treat the network and AI themes as gated evaluations, decided by Filter 1. Treat the device-dependent and federation-dependent checks as multi-quarter programs that depend on the attribute and device modernization work in Chapter 09 and the cutover sequencing in Chapter 10.

Federal mandates behind the baseline

CISA BOD 25-01 and the SCuBA baselines

CISA issued Binding Operational Directive 25-01, Implementing Secure Practices for Cloud Services, on December 17, 2024. It applies to Federal Civilian Executive Branch agencies and covers production cloud tenants for products that have a final SCuBA Secure Configuration Baseline.16 Its deadlines were:

BOD 25-01 required actions
Action Deadline
Report an inventory of in-scope cloud tenants (name and owning agency or component), then update it annually February 21, 2025
Deploy the SCuBA assessment tools (ScubaGear for Microsoft 365) and begin continuous reporting to CISA, or submit results quarterly April 25, 2025
Implement all mandatory SCuBA policies on the Required Configurations list June 20, 2025
Implement future mandatory policy updates On the timeline CISA posts
New in-scope tenants Mandatory policies and continuous monitoring in place before an Authorization to Operate is granted

The directive distinguishes mandatory “shall” policies from recommended “should” policies, which are left to the agency.17 For Microsoft Entra ID, the Required Configurations page lists twenty mandatory policies, from blocking legacy authentication (MS.AAD.1.1v1) through alerting on Global Administrator activation (MS.AAD.7.8v1).18 Policies the crosswalk table doesn’t already show:

Remaining BOD 25-01 mandatory Entra ID policies
SCuBA policy Requirement (paraphrased)
MS.AAD.3.2v1 If phishing-resistant MFA isn’t yet enforced, enforce an alternative MFA method for all users
MS.AAD.3.3v2 If Microsoft Authenticator is enabled, show login context information
MS.AAD.3.4v1 Set the Authentication Methods Manage Migration feature to Migration Complete
MS.AAD.7.1v1 Assign the Global Administrator role to between two and eight users
MS.AAD.7.2v1 Give privileged users finer-grained roles instead of Global Administrator
MS.AAD.7.5v1 Don’t provision highly privileged roles outside a privileged access management system
MS.AAD.7.7v1 Alert on eligible and active highly privileged role assignments
MS.AAD.7.8v1 Alert when a user activates the Global Administrator role

Two of these interact with Active Directory directly. MS.AAD.7.3v1, cloud-only privileged accounts, means every synced on-premises admin account that holds an Entra role is a finding. MS.AAD.3.4v1 retires the legacy per-user MFA and self-service password reset policies, which many hybrid tenants still carry. The required list changes; CISA notifies agencies of changes to mandatory policies, so the list on cisa.gov, not this table, is authoritative.19

OMB M-22-09

OMB M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, sets the identity goals that the phishing-resistant rows serve: enterprise-managed identities for agency staff, protected by phishing-resistant multifactor authentication.2021

The identity modernization specification

The program’s identity modernization specification is the cross-adapter contract for modernizing identity without building any vendor’s quirks into the authoritative source. It’s the program’s design, not an external requirement, and it’s what the crosswalk’s evidence rests on.

Contract requirements

  1. Dynamic groups are defined by rules over directory attributes.
  2. Administrative units and scoped roles replace delegation through organizational units.
  3. Access is computed from attributes, not assigned by hand.
  4. The rule set that turns attributes into access is itself the audit evidence.

Integration shape

  • Attribute writes for synced users are mastered in the directory, so the directory sync interval is the provisioning floor. With Microsoft Entra Connect Sync, that interval is 30 minutes by default.22
  • Device attributes are mastered in the cloud and written through the cloud API.
  • Downstream systems reference or synchronize from the authoritative origin; they don’t keep independent copies.

Chapter 05 describes how requirement 2 is built, and Chapter 09 describes the target the requirements produce.

NIST SP 800-53 Rev. 5 control mapping

The specification supports account management, access enforcement, and continuous monitoring controls by making access a computed property that can be regenerated from the authoritative attributes. The table maps the specification and the crosswalk to SP 800-53 Rev. 5 controls. Control identifiers and titles are checked against Release 5.2.0 of the catalog, issued August 27, 2025.2324 The mapping itself is the program’s: it shows where identity evidence supports a control, not a claim that any configuration satisfies a control by itself. The agency’s authorizing official and assessors decide that.

NIST SP 800-53 Rev. 5 controls the identity work supports
Control Title What the identity work contributes
AC-2 Account Management Lifecycle workflows driven by HR attributes; emergency access accounts defined and monitored
AC-2(1) Automated System Account Management Provisioning and dynamic group membership computed from attributes
AC-2(3) Disable Accounts Inactive and departed identities disabled by workflow, not by ticket
AC-2(7) Privileged User Accounts Cloud-only privileged accounts with just-in-time activation
AC-3 Access Enforcement Conditional Access evaluates every sign-in to Entra ID
AC-3(13) Attribute-based Access Control The attribute-to-access rule set (contract requirements 1, 3, and 4)
AC-6 Least Privilege Restricted consent and app registration; administrative units and scoped roles
AC-6(5) Privileged Accounts Privileged roles limited, managed in PIM, approval-gated
AC-6(7) Review of User Privileges Access reviews over groups, roles, and access packages
AU-2 Event Logging Entra sign-in and audit logs exported through diagnostic settings
AU-6 Audit Record Review, Analysis, and Reporting Sign-in and audit logs reviewed in the SIEM
AU-12 Audit Record Generation Every token issuance and directory change produces a record
CA-7 Continuous Monitoring ScubaGear reporting to CISA and the Zero Trust Assessment run on a schedule against the tenant
CM-6 Configuration Settings The baseline held as code and compared with the live tenant
IA-2 Identification and Authentication (Organizational Users) Cloud authentication to Entra ID for all workforce users
IA-2(1) Multi-factor Authentication to Privileged Accounts Phishing-resistant methods required for privileged roles
IA-2(2) Multi-factor Authentication to Non-privileged Accounts Phishing-resistant or alternative MFA for all users
IA-2(8) Access to Accounts — Replay Resistant Certificate-based authentication and FIDO2 credentials
IA-2(12) Acceptance of PIV Credentials Entra certificate-based authentication with PIV/CAC
IA-3 Device Identification and Authentication Managed-device and token-protection requirements
IA-5 Authenticator Management Authentication methods policy; legacy methods retired
IA-5(1) Password-based Authentication Banned-password list, smart lockout, no forced expiration
IA-8 Identification and Authentication (Non-organizational Users) Guest restrictions, sponsors, and inactive-guest removal
SC-23 Session Authenticity Device-bound sign-in session tokens
SI-4 System Monitoring Risky user and sign-in detection with blocking policies
TipContinue the book

← Previous: Chapter 11 — Reference Deployment · Book index · Next: Appendix B — Forest Assessment Module →

  1. Microsoft Learn, “What is Microsoft Entra certificate-based authentication?,” https://learn.microsoft.com/entra/identity/authentication/concept-certificate-based-authentication (accessed Oct 20, 2026).↩︎

  2. Microsoft Learn, “Configure Microsoft Entra for increased security (Preview),” https://learn.microsoft.com/entra/fundamentals/configure-security (accessed Oct 20, 2026).↩︎

  3. Microsoft Learn, “Configure Microsoft Entra for increased security (Preview),” https://learn.microsoft.com/entra/fundamentals/configure-security (accessed Oct 20, 2026).↩︎

  4. Microsoft Learn, “Known limitations for Global Secure Access,” section “Global Secure Access In Government Cloud limitations,” https://learn.microsoft.com/entra/global-secure-access/reference-current-known-limitations (accessed Oct 20, 2026).↩︎

  5. Microsoft Learn, “Configure Microsoft Entra for increased security (Preview),” https://learn.microsoft.com/entra/fundamentals/configure-security (accessed Oct 20, 2026).↩︎

  6. Microsoft Learn, “Known limitations for Global Secure Access,” section “Global Secure Access In Government Cloud limitations,” https://learn.microsoft.com/entra/global-secure-access/reference-current-known-limitations (accessed Oct 20, 2026).↩︎

  7. Microsoft Learn, “Dynamics 365 US Government,” https://learn.microsoft.com/power-platform/admin/microsoft-dynamics-365-government (accessed Oct 20, 2026). The page contrasts GCC High and DoD, which use Microsoft Entra Government, with GCC, which uses the public Microsoft Entra ID service.↩︎

  8. Microsoft Learn, “Configure Microsoft Entra for increased security (Preview),” https://learn.microsoft.com/entra/fundamentals/configure-security (accessed Oct 20, 2026).↩︎

  9. Microsoft Learn, “Configure Microsoft Entra for increased security (Preview),” https://learn.microsoft.com/entra/fundamentals/configure-security (accessed Oct 20, 2026).↩︎

  10. Cybersecurity and Infrastructure Security Agency, “BOD 25-01: Implementing Secure Practices for Cloud Services Required Configurations,” https://www.cisa.gov/resources-tools/services/bod-25-01-implementing-secure-practices-cloud-services-required-configurations (accessed Oct 20, 2026).↩︎

  11. Microsoft Learn, “Implement password hash synchronization with Microsoft Entra Connect Sync,” https://learn.microsoft.com/entra/identity/hybrid/connect/how-to-connect-password-hash-synchronization (accessed Oct 20, 2026).↩︎

  12. Microsoft Learn, “Configure Microsoft Entra for Zero Trust: Protect identities and secrets,” https://learn.microsoft.com/entra/fundamentals/zero-trust-protect-identities (accessed Oct 20, 2026).↩︎

  13. Office of Management and Budget, M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, January 26, 2022, https://bidenwhitehouse.archives.gov/wp-content/uploads/2022/01/M-22-09.pdf (accessed Oct 20, 2026).↩︎

  14. Cybersecurity and Infrastructure Security Agency, “BOD 25-01: Implementing Secure Practices for Cloud Services Required Configurations,” https://www.cisa.gov/resources-tools/services/bod-25-01-implementing-secure-practices-cloud-services-required-configurations (accessed Oct 20, 2026).↩︎

  15. Microsoft Learn, “Meet multifactor authentication requirements of memorandum 22-09,” https://learn.microsoft.com/entra/standards/memo-22-09-multi-factor-authentication (accessed Oct 20, 2026).↩︎

  16. Cybersecurity and Infrastructure Security Agency, BOD 25-01, Implementing Secure Practices for Cloud Services, December 17, 2024, https://www.cisa.gov/news-events/directives/bod-25-01-implementing-secure-practices-cloud-services (accessed Oct 20, 2026).↩︎

  17. Cybersecurity and Infrastructure Security Agency, BOD 25-01, Implementing Secure Practices for Cloud Services, December 17, 2024, https://www.cisa.gov/news-events/directives/bod-25-01-implementing-secure-practices-cloud-services (accessed Oct 20, 2026).↩︎

  18. Cybersecurity and Infrastructure Security Agency, “BOD 25-01: Implementing Secure Practices for Cloud Services Required Configurations,” https://www.cisa.gov/resources-tools/services/bod-25-01-implementing-secure-practices-cloud-services-required-configurations (accessed Oct 20, 2026).↩︎

  19. Cybersecurity and Infrastructure Security Agency, BOD 25-01, Implementing Secure Practices for Cloud Services, December 17, 2024, https://www.cisa.gov/news-events/directives/bod-25-01-implementing-secure-practices-cloud-services (accessed Oct 20, 2026).↩︎

  20. Office of Management and Budget, M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, January 26, 2022, https://bidenwhitehouse.archives.gov/wp-content/uploads/2022/01/M-22-09.pdf (accessed Oct 20, 2026).↩︎

  21. Microsoft Learn, “Meet multifactor authentication requirements of memorandum 22-09,” https://learn.microsoft.com/entra/standards/memo-22-09-multi-factor-authentication (accessed Oct 20, 2026).↩︎

  22. Microsoft Learn, “Microsoft Entra Connect Sync: Scheduler,” https://learn.microsoft.com/entra/identity/hybrid/connect/how-to-connect-sync-feature-scheduler (accessed Oct 20, 2026).↩︎

  23. National Institute of Standards and Technology, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations, September 2020 (updated December 10, 2020; Release 5.2.0, August 27, 2025), https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final (accessed Oct 20, 2026).↩︎

  24. National Institute of Standards and Technology, NIST SP 800-53 Rev. 5 catalog (OSCAL JSON, Release 5.2.0), usnistgov/oscal-content, https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json (accessed Oct 20, 2026).↩︎

Back to top