Skip to content

Conversation

@Arav0308-ms
Copy link
Collaborator

Description


This pull request updates the EntraID Scanner module by adding 3 new controls (1-Tenant and 2- User)

Details


  1. New Control 1:
  • Control Name: EntraID_Tenant_CAP_AuthN_Setup_Policies
  • Description: This control ensures that we have enabled CAP that helps to prevent malicious attacks on tenants by reducing conditions that compromise user accounts and prevent further compromise by taking appropriate actions.
  • Issue: To check that the security default is enabled or not we have to use
    Get-MgBetaPolicyIdentitySecurityDefaultEnforcementPolicy API that requires "Policy.Read.All" Scope that need admin access of the tenant.
  1. New Control 2:
  • Control Name: EntraID_User_AuthZ_Limit_Invite_Permissions_To_Admins
  • Description: This control checks that we have limited guest invite permissions to admins not to everyone.
  1. New Control 3:
  • Control Name: EntraID_User_AuthZ_Disable_Guest_Self_Service_Signup_Flow
  • Description: This control checks that we have not enable guest self-service sign up via user flows.
  • Issue: To check that the Self Service Signup flow is enabled or not we have to use Get-MgBetaPolicyAuthenticationFlowPolicy API that requires "Policy.Read.All" Scope that need admin access of the tenant.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants