Siemserva + Anthropic Claude

Yes, you have exposure. The Stryker breach exploited a compromised admin account to mass-wipe devices via Intune. In your environment: Multi-Admin Approval is not enabled for device wipe actions, 2 admin accounts use SMS-based MFA (vulnerable to SIM swap), and both have permanent Global Administrator assignments without PIM. A single compromised credential could wipe your entire managed device fleet. I also see no Conditional Access policy requiring compliant devices for admin portal access, which means these accounts can authenticate from unmanaged machines. Three things to fix immediately: enable MAA for destructive Intune actions, convert both accounts to FIDO2 MFA, and require PIM activation for Global Admin.

I traversed the identity graph and found 4 paths to Global Administrator through nested group memberships. Two are direct assignments (expected). But two reach Global Admin through group nesting: one account reaches it via IT-Admins → Tier-1-Ops → Directory Roles (2 hops), and a service principal reaches it via DevOps-Automation → Privileged-Ops → Directory Roles. The service principal has been inactive for 127 days with an expired credential, but the group membership is still active. If someone re-provisions that credential, they inherit Global Admin. This is the kind of hidden privilege escalation path that Microsoft's admin portals do not surface because no single dashboard shows the full group nesting chain combined with credential status.

You are failing 7 SCuBA controls across AAD and Exchange. The fastest to close: MS.AAD.1.1v1 (legacy auth blocking) can be fixed in under an hour with one Conditional Access policy. MS.AAD.3.1v1 (phishing-resistant MFA for privileged roles) is a 2-hour project to deploy FIDO2 keys to your 4 admin accounts. MS.EXO.1.1v2 (external forwarding) is a one-line Exchange transport rule. Those three close your highest-risk gaps before the auditor arrives. The remaining 4 controls involve Intune device compliance policies and SharePoint sharing settings that need broader coordination. Want me to generate a Compliance report with the full control-by-control status, or start with the PowerShell to fix the first three?

Preparing the report now. I have gathered 323 findings, filtered to AAD and Exchange domains. Here is my draft analysis: Executive Summary: Your Entra ID and Exchange configuration has 3 critical and 4 high gaps against CISA SCuBA controls. The most urgent is legacy authentication, which is currently allowed for all users... [Claude shows the full analysis] Does this look right? Want me to add more detail on the Exchange transport rules, or adjust the risk scoring? Once you approve, I will build the branded HTML report with compliance heatmaps, the SCuBA scorecard, and the remediation roadmap.

Good call. Adding positive observations: Security Defaults were replaced with targeted CA policies (MS.AAD.2.1v1 pass), DKIM and DMARC are properly configured for all domains (MS.EXO.4.1v1 pass), and PIM is enabled for 3 of 5 privileged roles. Building the report now with your changes... Report saved to Reports/Senserva_Compliance_2026-04-09.html