📌 Introduction
The Cloud Directory Posture is a critical security feature that continuously scans user activities, login patterns, and mailbox configurations across Google Workspace and Microsoft 365.
✅ Key Benefits:
🔍 Detects abnormal login locations & suspicious mailbox rules.
🛡️ Provides real-time security alerts for potential account takeovers.
🚀 Serves as the foundation for multiple Guardz security controls.
📌 Available in: Starter, Pro, and Ultimate Plans
💡 First Time Setup?
Before using Cloud Directory Posture, you must integrate your cloud provider:
📌 Navigating Cloud Directory Posture in Guardz
🔹 Where to Find It
1️⃣ Log into Guardz.
2️⃣ Navigate to Security Controls > Cloud Directory Posture.
3️⃣ In this dashboard, you can:
View all integrated cloud applications.
See the number of active users.
Manage Approved Locations.
🔹 Single Customer View Features
In Single Customer view, you can:
✅ Change license allocations.
✅ Activate the "Approved Locations" tool.
✅ View and edit the list of Approved Locations.
📌 Approved Locations & Abnormal Logins
🔹 How Does Guardz Identify Suspicious Logins?
Guardz analyzes historical login data for 7 days to establish a normal login benchmark.
If a login occurs outside the approved norm, it is flagged as abnormal.
Abnormal logins help detect potential account compromise & unauthorized access.
🔹 Managing Approved Locations in Guardz
1️⃣ Go to Security Controls > Cloud Directory Posture.
2️⃣ Click Edit to modify Approved Locations.
3️⃣ Approved Locations are tracked by:
IP Addresses 📍
Countries 🌍
Cities 🏙️
💡 You can add or remove locations anytime to refine detection accuracy.
✅ Removing a location:
Logins from that location will no longer generate an issue.
Existing issues related to that location will be closed.
✅ Adding a location:
You can specify either an IP address or City/Country.
For broader control, add an IP range (e.g.,
1.1.1.1/24) or allow an entire country.
🚨 Each newly added location requires a reason (system benchmark vs. admin approval).
📌 FAQ: Cloud Directory Security Insights
🔹 Why does an issue state “MFA Missing Member” even though MFA is enabled?
✅ Answer: The user may need to create a password specifically for MFA authentication.
🔹 How often does the MFA scan run?
✅ Answer: The scan runs every 2 hours, and immediately when new users are added within the tenant. If a user is deleted within the tenant, it can take up to 2 hours for the user to be removed within Guardz.
🔹 How does Guardz determine the benchmark for normal logins?
✅ Benchmark Rules:
Guardz pulls login activity from the last 7 days upon initial setup.
If a login occurs 3+ times from the same location, it becomes an approved benchmark location.
🔹 Why can’t I enable Audit Logs in Microsoft 365?
✅ Cause: Microsoft 365 Basic License does not support Audit Logs. You must upgrade to a higher-tier license.
🔹 How does Guardz classify suspicious login severity?
✅ Risk Level Criteria:
Risk Level | Condition |
🔴 Critical | Admin user logs in from a high-risk country |
🟠 High | Login from a suspicious country OR Admin login from an unrecognized location |
🟡 Medium | Other detected anomalies (e.g., unusual devices) |
🔵 Info | If all detections meet a known security benchmark |
📌 Benchmarks that Reduce False Positives:
✔ User-Agent Consistency – If a user logs in 100+ times from the same User-Agent in 30 days, it is considered safe.
✔ Device Agent Matching – If a known device logs in from a known IP, it is marked safe.
✔ IP Reputation Score – If the IP’s reputation score is 0, it is safe.
📌 Best Practices for Cloud Directory Security
✔ Regularly update Approved Locations to prevent unnecessary login alerts.
✔ Use Guardz MFA Enforcement to secure all accounts.
✔ Monitor login trends for potential account compromise attempts.
✔ Investigate & resolve abnormal login alerts quickly.