Connect Microsoft 365 for CMMC
Most of the people and sign-in requirements of CMMC Level 2 live in Microsoft 365: who must use multifactor sign-in, which old sign-in methods are allowed, how files can be shared. Instead of screenshots, Gardience can read those settings and show them as evidence on Security > CMMC Level 2, checked again every day.
Gardience only reads. It uses an app registration you create in Microsoft Entra ID, with read-only permissions, and never changes anything in your tenant. Organizations that do not connect Microsoft 365 are not affected: its checks are left out of the assessment.
What Gardience checks
| Check | Requirement | Passes when |
|---|---|---|
| M365-01 Multifactor sign-in required for everyone | 3.5.3 | Security defaults are on, or an enabled Conditional Access policy requires multifactor (or an authentication strength) for all users and all apps. Excluded emergency accounts are listed, not failed. |
| M365-02 Every enabled account is registered for multifactor | 3.5.3 | Every enabled member account has registered a multifactor method. |
| M365-03 Older sign-in methods are blocked | 3.5.3 | Security defaults are on, or an enabled Conditional Access policy for all users blocks Exchange ActiveSync and other legacy clients. |
| M365-04 No anonymous sharing links | 3.1.3 | SharePoint and OneDrive do not allow "Anyone" links. |
| M365-05 No enabled account unused for 90 days | 3.5.6 | Every enabled member account older than 90 days signed in within the last 90 days. |
| M365-06 Four or fewer Global Administrators | 3.1.5 | The Global Administrator role has four members or fewer. |
Report-only Conditional Access policies do not count: they do not enforce anything. M365-02 and M365-05 need Microsoft Entra ID P1 or P2 (included in Microsoft 365 Business Premium, E3, and E5); without it they show as unknown, not failed.
1. Create the app registration
In the Microsoft Entra admin center (entra.microsoft.com; for GCC High, entra.microsoft.us), as a Global Administrator:
- Open Identity > Applications > App registrations > New registration. Name it "Gardience CMMC evidence", choose Single tenant only (older screens say Accounts in this organizational directory only), leave the redirect URI empty, and choose Register.
- On its Overview, copy the Application (client) ID and the Directory (tenant) ID.
Open API permissions > Add a permission > Microsoft Graph > Application permissions and add:
Policy.Read.All(security defaults and Conditional Access)AuditLog.Read.All(multifactor registration and sign-in activity)User.Read.All(which accounts are enabled)RoleManagement.Read.Directory(Global Administrators)SharePointTenantSettings.Read.All(sharing settings)
- Choose Grant admin consent for your organization.
- Open Certificates & secrets > New client secret, choose how long it lasts (up to 24 months), and copy its Value (not the Secret ID). It is shown only once.
2. Connect it in Gardience
- Open Security > CMMC Level 2 and choose the Microsoft 365 tile.
- Enter the Directory (tenant) ID, the Application (client) ID, and the client secret value. Choose GCC High if your tenant is in Microsoft's government cloud.
- Choose Connect and check. Gardience signs in to Microsoft first and refuses a wrong ID or secret before saving anything. The results appear in the window, and as evidence under each requirement.
The secret is sealed in Gardience's vault and is never shown again. Only admins can connect, check, or disconnect Microsoft 365; every one of those steps is in the audit log.
When a check fails
Each failed check says what it found. Fix it in Microsoft 365, then choose Check now:
- M365-01, M365-03: turn on security defaults (Identity > Overview > Properties > Manage security defaults), or create Conditional Access policies that require multifactor for all users and block legacy authentication. Keep one or two emergency accounts excluded.
- M365-02: ask the listed people to register at aka.ms/mysecurityinfo.
- M365-04: in the SharePoint admin center, set sharing to New and existing guests or stricter.
- M365-05: disable or delete the listed accounts.
- M365-06: move people who do not need Global Administrator to a narrower role.
When the client secret expires, the check fails with a sign-in error: create a new secret and enter it under Change the app registration.