CreativeTechsBaseline
tenant security posture
CTB-25 · Tier 1 · Silent · M365 / GWS · P1

Block administrators from self-service password reset

Huntress Admins blocked from SSPR · High · Foundational1 authority
0
Tenants failing
0
Tenants meeting
0
Measured
REQUIRED
Disposition
The settingWhat we hold this to
CreativeTechs minimum
No account holding a privileged directory role is in the SSPR-enabled group. Administrators reset through the service desk.
Benchmark position
No published benchmark value in CIS, CISA or EIDSCA. Huntress rates it High · Foundational.
Where we differ, and why
A Huntress-only catch. Worth keeping on their judgement plus ours; note it has one authority behind it, not four.
Where the switch is
Entra admin centre → Protection → Password reset → Properties → Self service password reset enabled = Selected, and scope the group to exclude privileged accounts.
https://entra.microsoft.com
How to verify
Compare the SSPR-enabled group's members against /directoryRoles members. Expect no intersection.
Across the fleet
Client
State
Evidence
Blackwing
UNKNOWN
No Secure Score evidence — awaiting Maester.
BravicaOne
UNKNOWN
No Secure Score evidence — awaiting Maester.
CMG Law
UNKNOWN
No Secure Score evidence — awaiting Maester.
CreativeTechs
UNKNOWN
No Secure Score evidence — awaiting Maester.
DCG One
UNKNOWN
No Secure Score evidence — awaiting Maester.
Diversified Management Services
UNKNOWN
No Secure Score evidence — awaiting Maester.
Double Z
UNKNOWN
No Secure Score evidence — awaiting Maester.
Electric Pen
UNKNOWN
No Secure Score evidence — awaiting Maester.
Graphiti Associates
UNKNOWN
No Secure Score evidence — awaiting Maester.
Guidance Engineering
UNKNOWN
No Secure Score evidence — awaiting Maester.
India Tree
UNKNOWN
No Secure Score evidence — awaiting Maester.
MIR Corp
UNKNOWN
No Secure Score evidence — awaiting Maester.
Phinney Bischoff
UNKNOWN
No Secure Score evidence — awaiting Maester.
Quiver Dental
UNKNOWN
No Secure Score evidence — awaiting Maester.
RHO Architects
UNKNOWN
No Secure Score evidence — awaiting Maester.
Retail Voodoo
UNKNOWN
No Secure Score evidence — awaiting Maester.
Riverstone
UNKNOWN
No Secure Score evidence — awaiting Maester.
SSF
UNKNOWN
No Secure Score evidence — awaiting Maester.
Slingshot Architecture
UNKNOWN
No Secure Score evidence — awaiting Maester.
Stoke
UNKNOWN
No Secure Score evidence — awaiting Maester.
Turnstyle
UNKNOWN
No Secure Score evidence — awaiting Maester.
Urban Animal
UNKNOWN
No Secure Score evidence — awaiting Maester.
WLIHA
UNKNOWN
No Secure Score evidence — awaiting Maester.
Zak Designs
UNKNOWN
No Secure Score evidence — awaiting Maester.
Why it matters
SSPR on a privileged account turns a compromised recovery method into a path to Global Admin without ever knowing the password.
How we check
Huntress (High · Foundational). No framework equivalent found — a Huntress-only catch.
Fix — M365
Entra → Password reset → scope the SSPR-enabled group to non-privileged users only.
Fix — Google
Google blocks super-admin self-recovery by default; confirm it hasn't been re-enabled.
User notices
Admins call us for resets instead of self-serving. That is the intent.
Expected pushback
Minimal — small population, and the break-glass account covers the lockout fear.