DSC Controls
Controls are the individual security checks that make up your baseline. Each control evaluates a specific aspect of your Microsoft 365 security configuration and provides remediation guidance when deviations are detected.
What are DSC Controls?
DSC stands for Desired State Configuration. A control defines a specific security requirement, how to detect when your environment deviates from that requirement, and how to remediate the deviation.
Example: PA-01 Control
Let's look at a common control to understand how they work:
Control ID: PA-01
Limit Permanent Global Administrators
What it checks:
No more than 3 permanent Global Administrators should exist in your tenant
Why it matters:
Excessive permanent privileged accounts increase attack surface and insider threat risk. Each Global Admin account is a potential path for attackers to gain full control of your tenant.
How it evaluates:
During a scan, TrueConfig counts all permanent Global Administrator assignments. If the count exceeds 3, the control fails and provides a list of affected users.
Result:
Pass if 3 or fewer, Fail if more than 3, with details about which accounts need review
Control Categories
TrueConfig organizes controls into eight security domains. Each category addresses a different aspect of identity security.
Identity & Authentication (ID-XX)
Controls that govern how users authenticate and prove their identity.
Privileged Access (PA-XX)
Controls for administrator accounts, privileged roles, and just-in-time access.
Conditional Access (CA-XX)
Policy-based access controls that enforce context-aware security requirements.
Application Hygiene (APP-XX)
Controls for app registrations, service principals, and API permissions.
Guest & External Users (EXT-XX)
Controls for external collaboration and B2B access.
Governance (GOV-XX)
Lifecycle management, access reviews, and automated governance.
Audit & Logging (LOG-XX)
Log retention, SIEM integration, and security monitoring.
How Control Evaluation Works
During each scan, TrueConfig evaluates your Microsoft 365 environment against your baseline controls. Here's what happens:
Evaluation Flow
Collect Current State
TrueConfig gathers information about your tenant - users, administrator roles, Conditional Access policies, app registrations, and security settings.
Load Your Baseline
Based on your selected baseline level (Level 1, 2, or 3), TrueConfig loads the appropriate controls. Level 1 includes 13 foundational controls, Level 2 adds 12 more (25 total), and Level 3 adds 9 additional controls (34 total).
Check Each Control
TrueConfig evaluates each control against your current configuration. For example, the PA-01 control counts permanent Global Administrators and compares it to the threshold of 3. If you have 5, the control fails and shows you which accounts are excessive.
Save Results
All evaluation results are saved, creating a history of your compliance posture over time. You can track whether your security is improving or declining.
Create Audit Trail
Every scan creates immutable audit records for compliance tracking and historical analysis. These records cannot be modified or deleted.
Control Status & Severity
Evaluation Status
Each control evaluation produces one of five statuses:
Pass
Your configuration meets the baseline requirement. No action needed.
Fail
Your configuration deviates from the baseline. Remediation required.
Warning
Partial compliance or minor issues detected. Review recommended.
Not Applicable
Control prerequisites not met (e.g., PIM control when no P2 licenses).
Error
Evaluation failed due to technical issue (API error, permission denied, etc.).
Severity Levels
Controls are assigned severity levels based on their security impact:
Critical
Configurations that could lead to complete tenant compromise (e.g., no break-glass accounts before enforcing MFA)
High
Major security risks that should be addressed quickly (excessive Global Admins, missing MFA, legacy authentication enabled)
Medium
Important but less urgent issues (apps without owners, long-lived secrets)
Low
Best practice recommendations (audit log retention, documentation)
Evidence & Remediation Guidance
When a control fails, TrueConfig provides detailed evidence and actionable remediation guidance.
What Evidence Shows You
When a control fails, TrueConfig provides detailed evidence explaining exactly what's wrong:
Example: PA-01 Evidence (Excessive Global Admins)
- Total number of Global Admins found: 5
- Maximum allowed by baseline: 3
- List of all affected users with their names and email addresses
- When each admin was assigned the role
Example: APP-02 Evidence (Secret Expiration)
- Total secrets in your tenant: 25
- Secrets expiring after 12 months: 8
- Secrets that never expire: 3
- List of problematic apps with their secret expiration dates
Remediation Modes
Controls support different remediation modes based on their risk profile:
Advisory Mode
TrueConfig provides step-by-step instructions with links to Microsoft documentation. You manually implement the fix. Best for high-risk changes or learning mode.
Manual Mode
One-click remediation after you review and approve the planned changes. TrueConfig shows you exactly what will change before you commit. Requires approval for each execution.
Auto Mode
Automatic remediation with safety gates. TrueConfig detects the drift, validates safety gates pass, applies the fix, and records audit events. Only available for low-blast-radius controls.
Control Lifecycle
Controls evolve through their lifecycle from implementation to production:
Beta Controls
New controls in testing. Enabled for Pro and Scale plans only. May have incomplete evaluators or provisional remediation guidance.
Stable Controls
Production-ready controls with complete evaluators, remediation guidance, and audit trails. Available to all plan tiers.
Deprecated Controls
Controls being phased out (e.g., replaced by improved version). Remain enabled for backward compatibility but new baselines use the replacement.
Next Steps
Complete Control Reference
Detailed documentation for all 34 controls including evaluation logic, evidence schema, and remediation procedures.
Auto-Remediation Guide
Learn how to safely enable automatic remediation with safety gates, approval workflows, and rollback procedures.