Decompose Defender baseline policy associations with other M365 products

[schrolla]

💡 Summary

Develop a list of associations between current Defender policies and other M365 services.

Motivation and context

Defender largely protects other services in M365 within the scope of the SCuBA baselines. As a result, looking into alternative ways to represent those protections closest to the M365 service being protected. This may introduce some duplication across baselines, but the analysis will help determine if such duplication is reasonable to make the baselines more directly actionable for users.

Implementation notes

Please provide details for implementation, such as:

• For every control in the Defender baseline analyze which other M365 services are protected
• Document the list of associations between each Defender policy and protected M365 services
• Not how Defender is used to protect or defend the M365 service and any specific policies associated
• Note duplication among the associations/relationships between Defender and specific other SCB policies
  (e.g., Policy X and Y are both protected by Defender anti-spam protections)

Acceptance criteria

How do we know when this work is done?

• A detailed mapping between Defender policies and other M365 services has been documented