The draft documents are at https://www.cisa.gov/scuba. They also include Azure AD and M365 Defender