Cloud Security: CIS GCP v5.0 and CIS Microsoft 365 v7.0 frameworks, Microsoft 365 certificate mode

[maximelb]

Documents two new compliance frameworks and the Microsoft 365 certificate connection mode.

compliance.md

• The framework list goes from thirteen to fifteen: cis-gcp-v5 (93 controls) and cis-m365-v7 (160 controls).
• A new "CIS benchmark versions" section. The old and new CIS ids run side by side, it gives the control counts per framework, and it says which Microsoft 365 reads need certificate mode.
• Licence-gated Microsoft 365 controls report NOT_ASSESSED, and the reason names the licence that is missing.

provider-setup/entra.md

• Authentication modes compared: the LimaCharlie-generated certificate (recommended) and a client secret, which reads Microsoft Graph only.
• The certificate flow: generate the certificate, run the setup script (what it does, the trusted-CA policy caveat, the manual Fabric step), enter the client ID, and automatic rotation. It also covers the API route, for setups that don't use the web app.
• The full permission list: 18 Microsoft Graph application permissions, plus the grants outside Graph (Exchange.ManageAsApp ×2, Global Reader, the Fabric admin setting, and the SharePoint opt-in).
• Why the SharePoint advanced settings are opt-in, and what reads NOT_ASSESSED without them.
• Every Test Provider check, including certificate and the m365_* plane checks.

api-reference.md: POST /providers/m365/certificate.

This should merge on the same day the web app release carrying the certificate wizard ships, alongside #448 (GCP provider setup).

Checks run locally: mkdocs build --strict is clean, markdownlint-cli2 reports 0 issues, and list numbering has 0 new breaks.

🤖 Generated with Claude Code

[maximelb]

Self-review (this repo does not use the AI review bot). I checked each factual claim against the product's current behavior:

• Framework ids, control counts (93 = 76 automated / 8 partly automated / 9 manual; 160 = 143 / 17) and the 37 licence-gated controls come from the shipped compliance catalogs. The licence reason text is quoted verbatim from the report.
• The permission tables match the web app wizard's permission list one for one (18 Graph application permissions + 5 other grants), including which grants are certificate-only and which are opt-in.
• The setup-script steps, prerequisites, the trusted-CA caveat, the Fabric manual step and the one-hour Exchange propagation note all follow the script the wizard generates.
• The Test Provider check ids (auth, certificate, client_id, graph_*, m365_*) are the collector's check ids. The m365_exo/scc/teams/fabric checks run only on Entra connections.
• The certificate route body, response fields, permissions (cloudsec.set + secret.set) and idempotency match the public API schema. Validity is 12 months, and rotation happens at 75% of the lifetime.
• mkdocs build --strict is clean, markdownlint-cli2 reports 0 issues, and no anchor links break.
  No open issues. Leaving this for Maxime to merge, on the day the web app release with the certificate wizard ships.