Setup
When you connect Microsoft GCC High through Secureframe's guided flow, we establish a boundary for Controlled Unclassified Information (CUI) and then apply a broad set of CMMC security controls across your tenant. This article summarizes what we create during setup and what we configure afterward. If you'd like more detail on any item or the reasoning behind it, just reach out.
Note: Looking for a more detailed list of changes? Log in and open the detailed list of Secureframe changes.
Secureframe begins by creating the identity boundary for your CUI environment:
Dedicated administrative unit named Defense Trust Boundary
Three security groups: CUI Users, IT Admins, and Super Admins
People you designate are added to the administrative unit and then to their respective group
To centralize emergency access, we assign the Super Admins group the Global Administrator role and then remove that role from each individual Super Admin, so Global Administrator is inherited through the group rather than held by specific people. The admin who connected Secureframe keeps their own assignment, because Microsoft doesn't let an account remove its own Global Administrator role
Also during setup:
SharePoint site named CUI Shared Drive, with Edit access for the CUI Users group and a CUI user as site owner. The admin who connected Secureframe is removed from the site
Custom GCC High IT Admin role for the IT Admins group
Sign-in hardening: disable SMS and voice as authentication methods; enable Microsoft Authenticator and FIDO2 security keys
Conditional Access policies in report-only mode so they can be reviewed before they're enforced, including:
Requiring MFA for all users (Super Admins excluded as break-glass)
Blocking legacy authentication
Risk-based policies that require MFA for risky sign-ins and a password change for compromised users (Entra ID P2 only)
User consent for apps turned off, so users can't approve OAuth data-access requests from applications
System-use notice at login: "This is an authorized U.S. system operated by [your organization] for approved business use only and may process Controlled Unclassified Information (CUI). By accessing this system, you consent to monitoring, recording, and auditing of all activity; unauthorized or improper use is prohibited and may result in disciplinary action and civil or criminal penalties."
Why this matters for CMMC: This establishes the access-control foundation CMMC requires. A scoped administrative boundary and role-based groups let you limit CUI access to authorized people and enforce least privilege and separation of duties (Access Control family). Holding Global Administrator through a controlled break-glass group keeps standing privilege low and makes privileged actions attributable. Requiring MFA and disabling weak factors meets the multifactor-authentication objective (Identification & Authentication, e.g., IA.L2-3.5.3), and the login system-use notice satisfies the requirement to display a use notification before granting access (AC.L2-3.1.9). Creating the policies in report-only first lets you validate impact before enforcing, so you meet the requirements without locking out authorized users.
After setup, Secureframe configures a range of service-specific settings across Microsoft Entra, Exchange Online, Microsoft Defender, Microsoft Purview, SharePoint, Teams, and Intune.
Authentication and passwords
In Microsoft Entra, we confirm the authentication-method posture from setup:
SMS and voice disabled
Microsoft Authenticator and FIDO2 enabled
Banned-password list with smart lockout to resist password-guessing attacks
Disable password expiration on the default domain, in line with current guidance that favors strong, unexpiring passwords backed by MFA over forced rotation
Why this matters for CMMC: The Identification & Authentication family requires strong authenticator management, multifactor authentication for access to CUI and protection against weak or easily guessed passwords (IA.L2-3.5.x). Phishing-resistant methods, a banned-password list, and smart lockout directly support those objectives, and removing forced expiration aligns with federal guidance (NIST SP 800-63B), which favors long, unique, MFA-backed credentials over rotation that tends to weaken password quality.
Identity, users, and external access
We tighten who can do what in your directory:
End users are blocked from registering new applications
End users are blocked from consenting to applications that request access to your data
Guest access is restricted so that only admins and designated guest inviters can invite guests
Guests are placed in the Restricted Guest User role
Why this matters for CMMC: Access Control requires you to limit system access to authorized users and to control the flow of CUI, including connections to external systems (AC.L2-3.1.x, including external-connection controls). Blocking user app registration and consent prevents unsanctioned applications from gaining access to CUI, and restricting guest invitations and guest privileges ensures external access to your environment is allowed only where it's explicitly authorized.
Conditional access
Beyond the setup policies, we add a fuller set of Conditional Access policies in Microsoft Entra. Like the setup policies, they start in report-only mode unless you choose to turn them on during guided setup:
Blocking legacy authentication
Requiring MFA for all users (Super Admins excluded as break-glass)
Requiring a managed device (Intune-compliant or hybrid Entra joined) for all users, with virtual desktop apps excluded
Enforcing a one-hour session timeout
Blocking high-risk sign-ins and high-risk users (Entra ID P2 only)
Blocking device code flow
Requiring MFA for administrators
Create a System Use Notice terms-of-use statement and require users to accept it at login
Why this matters for CMMC: These policies enforce Access Control and System & Communications Protection at the point of sign-in. Requiring MFA and a managed device, and blocking legacy protocols that cannot satisfy MFA (SC.L2-3.13.8), keep access limited to authorized users on trusted devices. Limiting session lifetime supports session-termination requirements, MFA for administrators reinforces privileged-access control, and the terms-of-use acceptance reinforces the system-use-notification requirement (AC.L2-3.1.9). The risk-based policies support System & Information Integrity and Incident Response by reacting to compromised credentials and risky sign-ins.
Privileged access
To protect your most sensitive roles, we harden Privileged Identity Management activation for Global Administrator, Privileged Role Administrator, and Privileged Authentication Administrator (Entra ID P2 only) so that activating them requires:
Approval from the IT Admins group
MFA
A justification
A two-hour activation cap
Why this matters for CMMC: Access Control requires least privilege and tight control of privileged accounts (AC.L2-3.1.5 through 3.1.7). Time-bound, approval-gated, MFA-protected activation for your most powerful (Tier-0) roles ensures administrative rights are granted only when needed and are fully attributable, which reduces standing privilege and supports accountability for privileged use.
Apps and services
We reduce unnecessary exposure by:
Disabling the Cortana service principal
Disabling Microsoft Forms (per user, via licensing)
Disabling Microsoft Bookings tenant-wide
Setting a 15-minute idle timeout for web sessions
Why this matters for CMMC: Configuration Management requires the principle of least functionality, providing only essential capabilities and disabling nonessential services (CM.L2-3.4.6 and 3.4.7). Turning off unused services such as Cortana, Forms, and Bookings reduces the attack surface and the number of unsanctioned data paths, and the short web-session idle timeout enforces session termination after inactivity (AC.L2-3.1.11).
Email security
In Exchange Online and Microsoft Defender, we apply extensive email protections.
Exchange / mail flow
A mail-flow rule encrypts CUI-labeled email and requires TLS when sending it
Block external auto-forwarding
Block mailbox forwarding to external recipients
Configure an outbound TLS partner connector named Require TLS to Partners
Disable auto-forwarding on the default remote domain
Disable SMTP client authentication tenant-wide
Disable POP and IMAP on the default mailbox plan
For each custom domain, provision a DKIM key pair and CNAME selectors (with signing left disabled until you publish the records)
Microsoft Defender
Aggressive anti-phishing with quarantine actions; protect your organization's email domains from impersonation
Enable Safe Attachments with dynamic delivery
Extend Safe Attachments to SharePoint, OneDrive, and Teams
Turn on Safe Links scanning across email, Teams, and Office
Default malware filter blocks roughly fifty executable and script attachment types and enables zero-hour auto-purge with admin notifications
Default connection filter clears any IP allow-list and disables the safe-list
Default content filter quarantines high-confidence spam, tightens inbound anti-spam thresholds, clears sender allow-lists, and enables phishing zero-hour auto-purge
Bootstrap Microsoft's recommended presets: the EOP Standard preset for anti-spam, anti-phishing, and anti-malware, and the ATP Strict preset for Safe Attachments and Safe Links, and normalize the preset rules to apply to all recipients
Why this matters for CMMC: Email is a primary path for CUI to leave your boundary and for threats to enter, so these controls support System & Communications Protection and System & Information Integrity. Blocking external forwarding, disabling legacy mail protocols, and requiring TLS and encryption for CUI email protect the confidentiality and integrity of CUI in transit (SC.L2-3.13.8 and 3.13.11). Anti-phishing, Safe Attachments and Safe Links, and strict malware and spam filtering provide the malicious-code protection and monitoring CMMC expects (SI.L2-3.14.x), and DKIM helps protect message authenticity.
Audit, labeling, and data loss prevention
In Microsoft Purview:
Enable unified audit log ingestion and mailbox auditing for all users
Set unified audit log retention to twelve months (requires Microsoft Purview Audit (Premium); on tenants without that license, Microsoft's default retention applies)
Create CUI and General sensitivity labels and a label policy (General has no marking or encryption, for everyday email)
Create a data loss prevention policy that blocks people outside your organization from opening CUI-labeled files in SharePoint and OneDrive, unless the person sharing gives a business reason, which is logged
Protection alerts for high-severity events (administrator role changes)
Protection alerts for medium-severity events (DLP rule matches and external sharing invitations)
Why this matters for CMMC: The Audit & Accountability family requires you to create, protect, and retain audit records sufficient to monitor activity and investigate incidents (AU.L2-3.3.1 and 3.3.2), which is why we enable unified and mailbox auditing and retain logs for twelve months. Sensitivity labeling and DLP support Media Protection and Access Control by marking CUI and preventing its unauthorized sharing, and the protection alerts support the Incident Response family by surfacing high-risk events for timely detection and handling.
SharePoint and OneDrive
In the SharePoint admin center (the sharing settings apply to the CUI Shared Drive site only):
Restrict external sharing to existing guests only, unless your tenant or the site is already set to Only people in your organization
Restrict sharing to an allow-list that starts with your tenant's own verified domains, so sharing to outside domains is blocked until you add approved partner domains
Expire external guests' access to the CUI site after 30 days
Block file downloads on unmanaged devices, while allowing sync on Entra-joined devices
Enable a one-hour idle session sign-out
Disable Microsoft Loop
Block custom scripts
Why this matters for CMMC: These settings govern how CUI stored in SharePoint and OneDrive can be shared and accessed, supporting Access Control's limits on CUI flow and external sharing (AC.L2-3.1.3, 3.1.20, and 3.1.22). Restricting external sharing, blocking downloads on unmanaged devices, and enforcing idle sign-out keep CUI inside the authorized boundary and on managed devices, while disabling custom scripts reduces configuration risk in line with least-functionality requirements.
Microsoft Teams
In the Teams admin center, we configure meeting and app policies for a controlled collaboration environment:
Federated access uses empty allow and block lists
Global meeting policy auto-admits only people in your organization (PSTN callers cannot bypass the lobby)
Blocks anonymous users from starting or joining
Blocks external participants from taking control
Blocks cloud recording
Live-events policy lets organizers choose whether to record
Block third-party file services (Dropbox, Box, Google Drive, ShareFile, and Egnyte) and email-into-channel
Restrict apps through permission and setup policies so that global, default, and private catalog apps are limited to an allowed-app list and sideloading is disabled
Why this matters for CMMC: Teams is a real-time collaboration and data-sharing surface, so these policies enforce Access Control over who can participate and what can be shared (AC.L2-3.1.x) and least functionality over what apps and integrations are available (CM.L2-3.4.x). Controlling meeting admission, anonymous join, external control, recording, and federation keeps CUI discussions limited to authorized participants, and blocking third-party storage and unapproved apps prevents CUI from flowing to unsanctioned services.
Device compliance
In Microsoft Intune, if you opted in to automatic Intune configuration during setup, we create device compliance policies and configuration profiles for Windows, macOS, and Linux, covering disk encryption, screen lock, firewall, Microsoft Defender, and minimum OS versions. Windows devices need Windows 11 23H2 or later. See Intune configuration for GCC High and CMMC compliance for the full list of policies and their settings.
Why this matters for CMMC: CMMC requires that devices accessing CUI meet an established security baseline (Configuration Management, CM.L2-3.4.1 and 3.4.2) and that only compliant, managed devices connect. This compliance policy defines that baseline. Secure Boot, disk encryption, a device password, and active malware protection, so the "Require Managed Device for Authentication" Conditional Access policy has a standard to enforce. Together they deliver device-based access control and protect CUI at rest through encryption.