Collaboration test plan

What to test on a Collaboration release so the baseline still holds: the owner's templates, by area

Derive from Collaboration has no STIG checks in the Register yet; the plan is the owner's templates, with the release and hardware you choose ruling steps in or out. Owner's templates

The release under test Version Hardware

Areas to test Authentication 3 MDM enrolment 3 Collaboration and meeting rooms 11 Untick an area to leave it out of the exports; it stays on the page, marked as not tested this time.

Export the kept checks Report look Untick a check, then Rebuild or export; the form carries the state and nothing is stored. One area is drawn at a time; what you untick in one is kept when you open another, and every export covers the whole plan: the checks kept, what was left out and why, a findings table and a sign-off.

The report looks

Plain: Calibri and grey tables, nothing else: the look before styles.
Formal assessment: A government assessment report in the SP 800-53A manner: serif headings, numbered sections, cover page. Cover page. Numbered sections.
Engineering runbook: For the engineer at the keyboard: monospaced headings, dark command blocks. Numbered sections.
Executive: Navy and teal with a cover page: for the people who sign it off. Cover page.
Compact checklist: Black on white, small type, no cover: prints the most checks per page.
Modern: A clean product look in indigo and slate.
Dark console: Light text on a dark page, terminal colours: for screens, not paper.
Board: Issue-tracker blues and lane greys, as the decisions board draws them.
Audit workpaper: Ledger green and auditor blue, with room for initials and references. Cover page. Numbered sections.
Markdown-native: How the report reads on GitHub: system fonts, ruled headings, grey code.
Word: Office's own blues: the house style of a document written in Word. Cover page. Numbered sections.

The look applies to Word, PDF, LaTeX and the printable checklist; Markdown, CSV and JSON stay plain. Each follows one of the mockups in docs/mockups/exports.

Link to this plan: the release, hardware and areas as a URL to bookmark or send; unticked checks do not travel with it.

Authentication 3 kept

owner's template With the test account, open the Conditional Access "What If" tool for the new device and confirm which policies apply.
Microsoft Learn, "Troubleshoot Conditional Access with the What If tool" (Conditional Access holds on the new release)
Success looks like: The policies requiring a compliant device and multifactor authentication are listed as applying.
owner's template Sign in from the new device and confirm the multifactor prompt appears once, then the session holds.
Microsoft Learn, "Plan a Conditional Access deployment" (Conditional Access holds on the new release)
Success looks like: One multifactor challenge; later sign-ins within the session lifetime are silent.
owner's template Make the device non-compliant (lapse one compliance setting) and confirm access is blocked, then restore it and confirm access returns after the next check-in.
Microsoft Learn, "Plan a Conditional Access deployment" (Conditional Access holds on the new release)
Success looks like: Blocked while non-compliant; allowed again after the device reports compliant.

Any release

Choose a version and hardware above and the plan leaves out what does not apply to them, saying why. Every release and the hardware it runs on is on the Fleet page.

Checks

Tested: 17 from the owner's templates
By area: Authentication 3, MDM enrolment 3, Collaboration and meeting rooms 11

Templates 4

Samsung meeting-room displays and signage 6 steps · Collaboration and meeting rooms · collaboration-samsung-displays.yaml
The team's meeting rooms run Samsung displays. The interactive WAD and WAF series are Android devices (Google EDLA-certified, Knox Manage licence included), so Android Enterprise and Knox controls apply to them; the smart signage line runs Tizen and is managed through MagicINFO Server. Samsung publishes display advisories as SVP-<month>-<year> on its TV and display security page and has no feed; a monthly read is a step here.
Microsoft Teams Rooms systems behind the room displays 5 steps · Collaboration and meeting rooms · collaboration-teams-rooms.yaml
The console and compute behind a Samsung display. A Teams Rooms on Windows system is a Windows 11 IoT Enterprise PC and takes the Windows hardware plan too; a Teams Rooms on Android device is managed through the Teams admin center and Intune's AOSP management.
Conditional Access holds on the new release 3 steps · Authentication · conditional-access.yaml
Whatever the platform, the new OS release must still satisfy the compliance and device-state signals the Conditional Access policies ask for.
Automated enrolment and the baseline profiles on a wiped device 3 steps · MDM enrolment · mdm-enrolment.yaml
The first thing to test on a new release is that a wiped device enrols without a hand on it and receives the baseline.

Templates are YAML files under data/test-plans in the repository; the owner extends them by adding a file. Each says which releases and hardware it applies to, what success looks like and what to do when a step fails, and cites the document it follows. They are labelled as the owner's, not the publisher's.

How the areas are chosen

Each check is filed by the words in its title (then its procedure): Secure Enclave, TPM, secure boot and attestation under the hardware root of trust; Platform SSO, Entra, Kerberos and passkeys under SSO; BitLocker, FileVault and LUKS under disk encryption; passwords, smart cards, session lock and sudo under authentication; audit and logs under logging; firewall, SMB, SSH, TLS, Bluetooth and sharing under network; updates and releases under updates; enrolment and management under MDM; browsers by name; meeting rooms under collaboration. The rest is "everything else". The words are the publishers'; only the filing is this product's.

Fleet · All baselines