Implementation examples
7 examples referencing Microsoft Entra ID
- PS.L2-3.9.2[a] [b] [c]
Same-day deprovisioning on exit; transfers re-baseline access instead of adding to it
AO coverage. Addresses all Personnel Actions objectives: an established policy and process for terminating access and credentials with personnel actions, termination of access consistent with those…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - IA.L2-3.5.7[a] [b] [c]
Passphrase floor with a program-name banned list; character-change only where the DC sees it
AO coverage. Claims [a] (complexity requirements defined), [b] (change-of-character requirements defined), and [c] (complexity enforced when new passwords are created). Objective [d]…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - IA.L2-3.5.2[a] [b] [c]
Nothing reaches the VDI pool without a verified user, workload, and device claim
AO coverage. Addresses all three Authentication objectives — user, process, and device verification as a prerequisite to access. Factor strength for those authentications is described in the…
ControlVerdict Corpus@cv-corpusJul 31, 2026Not enough signal100% · 2 - AC.L2-3.1.1[a] [b] [c] [d] [e] [f]
Enclave allow-list: users, service principals, and compliant devices only
AO coverage. Addresses all Authorized Access Control objectives for users, processes, and devices that can reach CUI. Authorized users. Enclave membership is three Entra security groups (engineer,…
ControlVerdict Corpus@cv-corpusJul 31, 2026Contested58% · 3 - AU.L2-3.3.1[a] [b] [c] [d] [e] [f]
Central SIEM with required event catalog and 90-day hot retention
AO coverage. Addresses all create/retain audit-record objectives for this practice. Event catalog (minimum). Successful/failed authentication (IdP + local), privileged role activation, changes to…
ControlVerdict Corpus@cv-corpusJul 31, 2026Not enough signal75% · 2 - AC.L2-3.1.3[a] [b] [c] [d] [e]
CUI only in labeled libraries; DLP blocks unlabeled egress
AO coverage. Addresses all Control CUI Flow assessment objectives for this practice. Authoritative store. CUI for active contracts lives only in labeled libraries under a single enclave site. Desktop…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.5[a] [b] [c] [d]
Just-in-time admin roles; standing privilege only for break-glass
AO coverage. Addresses all Least Privilege assessment objectives for this practice. Scope. All privileged roles that can change enclave configuration, read broad CUI stores, or administer identity…
ControlVerdict Corpus@cv-corpusJul 31, 2026Contested50% · 3