Back to App
DocsHome
Docs/Controls/Control Reference

Control Reference

Complete catalog of all DSC (Desired State Configuration) controls available in TrueConfig. Controls are organized by category and baseline level.

Control Categories

Controls are organized into the following categories based on their security domain:

Privileged Access (PA)

Controls governing administrative access, Global Admin posture, PIM usage, and emergency access accounts.

Conditional Access (CA)

Controls for authentication policies, legacy auth blocking, risk-based access, and device compliance.

Identity Hygiene (ID)

Controls for password protection, SSPR, MFA enforcement, and identity synchronization health.

Applications (APP)

Controls for app consent workflows, high-risk permissions, and third-party application governance.

Governance (GOV)

Controls for stale accounts, guest access, privileged access reviews, and external collaboration.

Logging (LOG)

Controls for audit log retention, SIEM integration, and security monitoring.

Level 1: Recommended Security (13 controls)

Foundational security controls that every organization should implement. These controls establish basic security hygiene and prevent common attack vectors.

Control IDTitleSeverity
PA-01Standing Global Admin PostureCritical
PA-02Emergency Access ComplianceHigh
PA-03PIM Coverage and PostureHigh
EA-01Break-Glass Accounts ConfiguredHigh
CA-01Legacy Authentication BlockingCritical
CA-02Device Compliance for AdminsHigh
ID-01Synchronized Identity HealthMedium
ID-02Password Protection EnabledHigh
ID-03Self-Service Password Reset ConfiguredMedium
GOV-01Stale User AccountsMedium
EXT-01Guest User Access RestrictedHigh
APP-01High-Risk Application Permissions RestrictedHigh
LOG-01Audit Log Retention and ExportMedium
Baseline Evaluation
When you select Level 1 baseline, only these 13 controls are evaluated. Higher baseline levels include these controls plus additional controls.

Level 2: Enhanced Security (11 additional controls)

Advanced security controls for organizations with higher security requirements. Includes all Level 1 controls plus:

Control IDTitleLicense
PA-04PIM Required for Privileged RolesEntra ID P2
PA-05Phishing-Resistant MFA for Privileged UsersEntra ID P1
CA-03Risk-Based Sign-In ProtectionEntra ID P2
CA-04User Risk ProtectionEntra ID P2
DV-01Admin Device Trust RequirementsEntra ID P1, Intune
APP-03High-Risk Graph Permissions ReviewNone
APP-04Admin Consent WorkflowNone
GOV-02Automated Stale Account RemediationEntra ID P2
GOV-03Privileged Access ReviewsEntra ID P2
LOG-02Extended Log RetentionEntra ID P1
PA-01-L2Zero Permanent Global AdministratorsEntra ID P2

Level 3: Maximum Security (10 additional controls)

Zero-trust security controls for highly regulated industries. Includes all Level 1 and Level 2 controls plus:

Control IDTitleLicense
PA-06Hardware Security Key Required for AdminsEntra ID P2
PA-07Continuous Access EvaluationEntra ID P1
CA-05Zero Trust Network AccessEntra ID P2, Intune
CA-06Privileged Access WorkstationsEntra ID P2, Intune
ID-04Phishing-Resistant MFA for All UsersEntra ID P1
EXT-03Strict External CollaborationEntra ID P1
GOV-04Real-Time Threat ResponseEntra ID P2
LOG-03Real-Time Security MonitoringEntra ID P2, Sentinel
License Requirements
Level 2 and Level 3 controls require specific Microsoft licenses (Entra ID P1/P2, Microsoft Intune). Verify your organization has the required licenses before enabling these controls.

Control Evaluation

Controls are evaluated during each tenant sync. The DSC evaluation engine:

  • Fetches current configuration from Microsoft Graph API
  • Compares against desired state defined in control
  • Records deviations with detailed context
  • Triggers remediation workflows if auto-remediation is enabled
Best Practice
Start with Level 1 baseline for new implementations. Monitor for 2-4 weeks, review deviations, then progressively adopt Level 2 and Level 3 controls as your security maturity increases.
Auto-RemediationTechnical Overview