|
| 1 | +from prowler.lib.check.models import Check, CheckReportM365 |
| 2 | +from prowler.providers.m365.services.entra.entra_client import entra_client |
| 3 | +from prowler.providers.m365.services.entra.entra_service import ( |
| 4 | + ConditionalAccessGrantControl, |
| 5 | + ConditionalAccessPolicyState, |
| 6 | + InsiderRiskLevel, |
| 7 | +) |
| 8 | + |
| 9 | +OFFICE365_APP_ID = "Office365" |
| 10 | + |
| 11 | + |
| 12 | +class entra_conditional_access_policy_block_o365_elevated_insider_risk(Check): |
| 13 | + """Check if a Conditional Access policy blocks Office 365 access for elevated insider risk users. |
| 14 | +
|
| 15 | + This check verifies that at least one enabled Conditional Access policy blocks |
| 16 | + access to Office 365 applications for users with elevated insider risk levels, |
| 17 | + as determined by Microsoft Purview Adaptive Protection. |
| 18 | +
|
| 19 | + - PASS: At least one enabled policy blocks Office 365 access for users with elevated insider risk. |
| 20 | + - FAIL: No enabled policy blocks Office 365 access based on insider risk signals. |
| 21 | + """ |
| 22 | + |
| 23 | + def execute(self) -> list[CheckReportM365]: |
| 24 | + """Execute the check for insider risk blocking in Conditional Access policies. |
| 25 | +
|
| 26 | + Returns: |
| 27 | + list[CheckReportM365]: A list containing the result of the check. |
| 28 | + """ |
| 29 | + findings = [] |
| 30 | + report = CheckReportM365( |
| 31 | + metadata=self.metadata(), |
| 32 | + resource={}, |
| 33 | + resource_name="Conditional Access Policies", |
| 34 | + resource_id="conditionalAccessPolicies", |
| 35 | + ) |
| 36 | + report.status = "FAIL" |
| 37 | + report.status_extended = "No Conditional Access Policy blocks Office 365 access for users with elevated insider risk." |
| 38 | + |
| 39 | + for policy in entra_client.conditional_access_policies.values(): |
| 40 | + if policy.state == ConditionalAccessPolicyState.DISABLED: |
| 41 | + continue |
| 42 | + |
| 43 | + if "All" not in policy.conditions.user_conditions.included_users: |
| 44 | + continue |
| 45 | + |
| 46 | + if ( |
| 47 | + OFFICE365_APP_ID |
| 48 | + not in policy.conditions.application_conditions.included_applications |
| 49 | + and "All" |
| 50 | + not in policy.conditions.application_conditions.included_applications |
| 51 | + ): |
| 52 | + continue |
| 53 | + |
| 54 | + if ( |
| 55 | + ConditionalAccessGrantControl.BLOCK |
| 56 | + not in policy.grant_controls.built_in_controls |
| 57 | + ): |
| 58 | + continue |
| 59 | + |
| 60 | + # Policy targets all users, O365/All apps, and blocks access. |
| 61 | + # Now check if Adaptive Protection is providing insider risk signals. |
| 62 | + if policy.conditions.insider_risk_levels is None: |
| 63 | + report = CheckReportM365( |
| 64 | + metadata=self.metadata(), |
| 65 | + resource=policy, |
| 66 | + resource_name=policy.display_name, |
| 67 | + resource_id=policy.id, |
| 68 | + ) |
| 69 | + report.status = "FAIL" |
| 70 | + if policy.state == ConditionalAccessPolicyState.ENABLED_FOR_REPORTING: |
| 71 | + report.status_extended = f"Conditional Access Policy {policy.display_name} is configured in report-only mode to block Office 365 and Microsoft Purview Adaptive Protection is not providing insider risk signals." |
| 72 | + else: |
| 73 | + report.status_extended = f"Conditional Access Policy {policy.display_name} is configured to block Office 365 and Microsoft Purview Adaptive Protection is not providing insider risk signals." |
| 74 | + continue |
| 75 | + |
| 76 | + if policy.conditions.insider_risk_levels != InsiderRiskLevel.ELEVATED: |
| 77 | + continue |
| 78 | + |
| 79 | + report = CheckReportM365( |
| 80 | + metadata=self.metadata(), |
| 81 | + resource=policy, |
| 82 | + resource_name=policy.display_name, |
| 83 | + resource_id=policy.id, |
| 84 | + ) |
| 85 | + if policy.state == ConditionalAccessPolicyState.ENABLED_FOR_REPORTING: |
| 86 | + report.status = "FAIL" |
| 87 | + report.status_extended = f"Conditional Access Policy {policy.display_name} reports blocking Office 365 for elevated insider risk users but does not enforce it." |
| 88 | + else: |
| 89 | + report.status = "PASS" |
| 90 | + report.status_extended = f"Conditional Access Policy {policy.display_name} blocks Office 365 access for users with elevated insider risk." |
| 91 | + break |
| 92 | + |
| 93 | + findings.append(report) |
| 94 | + return findings |
0 commit comments