Skip to content

Commit 99a59bd

Browse files
danibarranqueroodanibarranqueroo
committed
chore: revision
1 parent f4ab25f commit 99a59bd

File tree

3 files changed

+21
-129
lines changed

3 files changed

+21
-129
lines changed

‎prowler/providers/m365/services/entra/entra_conditional_access_policy_block_elevated_insider_risk/entra_conditional_access_policy_block_elevated_insider_risk.py‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,9 @@ def execute(self) -> list[CheckReportM365]:
4242
if not policy.conditions.application_conditions:
4343
continue
4444

45+
if "All" not in policy.conditions.user_conditions.included_users:
46+
continue
47+
4548
if (
4649
"All"
4750
not in policy.conditions.application_conditions.included_applications
@@ -68,7 +71,7 @@ def execute(self) -> list[CheckReportM365]:
6871
report.status_extended = f"Conditional Access Policy {policy.display_name} is configured to block all cloud apps and Microsoft Purview Adaptive Protection is not providing insider risk signals."
6972
continue
7073

71-
if InsiderRiskLevel.ELEVATED not in policy.conditions.insider_risk_levels:
74+
if policy.conditions.insider_risk_levels != InsiderRiskLevel.ELEVATED:
7275
continue
7376

7477
report = CheckReportM365(

‎prowler/providers/m365/services/entra/entra_service.py‎

Lines changed: 0 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -546,31 +546,6 @@ def _parse_authentication_flows(auth_flows) -> "AuthenticationFlows | None":
546546

547547
return AuthenticationFlows(transfer_methods=transfer_methods)
548548

549-
@staticmethod
550-
def _parse_insider_risk_levels(raw_value):
551-
"""Parse insider risk levels from a Graph API flag enum value.
552-
553-
The insiderRiskLevels field in the Graph API is a flag enum
554-
(conditionalAccessInsiderRiskLevels). The msgraph SDK may
555-
represent it as an IntFlag, string enum, or raw string
556-
depending on the version. This method normalizes it into a
557-
list of InsiderRiskLevel enum values.
558-
559-
Args:
560-
raw_value: The raw insider risk levels value from the SDK.
561-
562-
Returns:
563-
A list of InsiderRiskLevel enum values present in the raw value.
564-
"""
565-
if raw_value is None:
566-
return None
567-
raw_str = str(raw_value).lower()
568-
return [
569-
InsiderRiskLevel(level)
570-
for level in ["minor", "moderate", "elevated"]
571-
if level in raw_str
572-
]
573-
574549
@staticmethod
575550
def _parse_app_management_restrictions(restrictions):
576551
"""Parse credential restrictions from the Graph API response into AppManagementRestrictions."""

‎tests/providers/m365/services/entra/entra_conditional_access_policy_block_elevated_insider_risk/entra_conditional_access_policy_block_elevated_insider_risk_test.py‎

Lines changed: 17 additions & 103 deletions
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,7 @@ def test_policy_disabled(self):
100100
),
101101
client_app_types=[],
102102
user_risk_levels=[],
103-
insider_risk_levels=[InsiderRiskLevel.ELEVATED],
103+
insider_risk_levels=InsiderRiskLevel.ELEVATED,
104104
),
105105
grant_controls=GrantControls(
106106
built_in_controls=[ConditionalAccessGrantControl.BLOCK],
@@ -180,7 +180,7 @@ def test_policy_enabled_for_reporting_only(self):
180180
),
181181
client_app_types=[],
182182
user_risk_levels=[],
183-
insider_risk_levels=[InsiderRiskLevel.ELEVATED],
183+
insider_risk_levels=InsiderRiskLevel.ELEVATED,
184184
),
185185
grant_controls=GrantControls(
186186
built_in_controls=[ConditionalAccessGrantControl.BLOCK],
@@ -417,7 +417,7 @@ def test_policy_no_application_conditions(self):
417417
),
418418
client_app_types=[],
419419
user_risk_levels=[],
420-
insider_risk_levels=[InsiderRiskLevel.ELEVATED],
420+
insider_risk_levels=InsiderRiskLevel.ELEVATED,
421421
),
422422
grant_controls=GrantControls(
423423
built_in_controls=[ConditionalAccessGrantControl.BLOCK],
@@ -452,10 +452,10 @@ def test_policy_no_application_conditions(self):
452452
assert result[0].resource_id == "conditionalAccessPolicies"
453453
assert result[0].location == "global"
454454

455-
def test_policy_does_not_target_all_apps(self):
456-
"""Test FAIL when the policy targets specific apps instead of all cloud apps."""
455+
def test_policy_does_not_target_all_users(self):
456+
"""Test FAIL when the policy targets specific users instead of all users."""
457457
policy_id = str(uuid4())
458-
display_name = "Block Insider Risk - Specific Apps"
458+
display_name = "Block Insider Risk - Specific Users"
459459
entra_client = mock.MagicMock
460460
entra_client.audited_tenant = "audited_tenant"
461461
entra_client.audited_domain = DOMAIN
@@ -483,21 +483,21 @@ def test_policy_does_not_target_all_apps(self):
483483
display_name=display_name,
484484
conditions=Conditions(
485485
application_conditions=ApplicationsConditions(
486-
included_applications=["Office365"],
486+
included_applications=["All"],
487487
excluded_applications=[],
488488
included_user_actions=[],
489489
),
490490
user_conditions=UsersConditions(
491491
included_groups=[],
492492
excluded_groups=[],
493-
included_users=["All"],
493+
included_users=[str(uuid4())],
494494
excluded_users=[],
495495
included_roles=[],
496496
excluded_roles=[],
497497
),
498498
client_app_types=[],
499499
user_risk_levels=[],
500-
insider_risk_levels=[InsiderRiskLevel.ELEVATED],
500+
insider_risk_levels=InsiderRiskLevel.ELEVATED,
501501
),
502502
grant_controls=GrantControls(
503503
built_in_controls=[ConditionalAccessGrantControl.BLOCK],
@@ -532,10 +532,10 @@ def test_policy_does_not_target_all_apps(self):
532532
assert result[0].resource_id == "conditionalAccessPolicies"
533533
assert result[0].location == "global"
534534

535-
def test_policy_no_insider_risk_levels(self):
536-
"""Test FAIL when the policy does not include elevated insider risk level."""
535+
def test_policy_does_not_target_all_apps(self):
536+
"""Test FAIL when the policy targets specific apps instead of all cloud apps."""
537537
policy_id = str(uuid4())
538-
display_name = "Block All Apps - No Insider Risk"
538+
display_name = "Block Insider Risk - Specific Apps"
539539
entra_client = mock.MagicMock
540540
entra_client.audited_tenant = "audited_tenant"
541541
entra_client.audited_domain = DOMAIN
@@ -563,7 +563,7 @@ def test_policy_no_insider_risk_levels(self):
563563
display_name=display_name,
564564
conditions=Conditions(
565565
application_conditions=ApplicationsConditions(
566-
included_applications=["All"],
566+
included_applications=["Office365"],
567567
excluded_applications=[],
568568
included_user_actions=[],
569569
),
@@ -577,7 +577,7 @@ def test_policy_no_insider_risk_levels(self):
577577
),
578578
client_app_types=[],
579579
user_risk_levels=[],
580-
insider_risk_levels=[],
580+
insider_risk_levels=InsiderRiskLevel.ELEVATED,
581581
),
582582
grant_controls=GrantControls(
583583
built_in_controls=[ConditionalAccessGrantControl.BLOCK],
@@ -657,7 +657,7 @@ def test_policy_no_block_grant_control(self):
657657
),
658658
client_app_types=[],
659659
user_risk_levels=[],
660-
insider_risk_levels=[InsiderRiskLevel.ELEVATED],
660+
insider_risk_levels=InsiderRiskLevel.ELEVATED,
661661
),
662662
grant_controls=GrantControls(
663663
built_in_controls=[ConditionalAccessGrantControl.MFA],
@@ -737,7 +737,7 @@ def test_policy_only_minor_insider_risk(self):
737737
),
738738
client_app_types=[],
739739
user_risk_levels=[],
740-
insider_risk_levels=[InsiderRiskLevel.MINOR],
740+
insider_risk_levels=InsiderRiskLevel.MINOR,
741741
),
742742
grant_controls=GrantControls(
743743
built_in_controls=[ConditionalAccessGrantControl.BLOCK],
@@ -817,7 +817,7 @@ def test_policy_enabled_and_compliant(self):
817817
),
818818
client_app_types=[],
819819
user_risk_levels=[],
820-
insider_risk_levels=[InsiderRiskLevel.ELEVATED],
820+
insider_risk_levels=InsiderRiskLevel.ELEVATED,
821821
),
822822
grant_controls=GrantControls(
823823
built_in_controls=[ConditionalAccessGrantControl.BLOCK],
@@ -854,89 +854,3 @@ def test_policy_enabled_and_compliant(self):
854854
assert result[0].resource_name == display_name
855855
assert result[0].resource_id == policy_id
856856
assert result[0].location == "global"
857-
858-
def test_policy_enabled_with_multiple_insider_risk_levels(self):
859-
"""Test PASS when policy includes elevated among multiple insider risk levels."""
860-
policy_id = str(uuid4())
861-
display_name = "Block Multiple Insider Risk Levels"
862-
entra_client = mock.MagicMock
863-
entra_client.audited_tenant = "audited_tenant"
864-
entra_client.audited_domain = DOMAIN
865-
866-
with (
867-
mock.patch(
868-
"prowler.providers.common.provider.Provider.get_global_provider",
869-
return_value=set_mocked_m365_provider(),
870-
),
871-
mock.patch(
872-
f"{CHECK_MODULE_PATH}.entra_client",
873-
new=entra_client,
874-
),
875-
):
876-
from prowler.providers.m365.services.entra.entra_conditional_access_policy_block_elevated_insider_risk.entra_conditional_access_policy_block_elevated_insider_risk import (
877-
entra_conditional_access_policy_block_elevated_insider_risk,
878-
)
879-
from prowler.providers.m365.services.entra.entra_service import (
880-
ConditionalAccessPolicy,
881-
)
882-
883-
entra_client.conditional_access_policies = {
884-
policy_id: ConditionalAccessPolicy(
885-
id=policy_id,
886-
display_name=display_name,
887-
conditions=Conditions(
888-
application_conditions=ApplicationsConditions(
889-
included_applications=["All"],
890-
excluded_applications=[],
891-
included_user_actions=[],
892-
),
893-
user_conditions=UsersConditions(
894-
included_groups=[],
895-
excluded_groups=[],
896-
included_users=["All"],
897-
excluded_users=[],
898-
included_roles=[],
899-
excluded_roles=[],
900-
),
901-
client_app_types=[],
902-
user_risk_levels=[],
903-
insider_risk_levels=[
904-
InsiderRiskLevel.MODERATE,
905-
InsiderRiskLevel.ELEVATED,
906-
],
907-
),
908-
grant_controls=GrantControls(
909-
built_in_controls=[ConditionalAccessGrantControl.BLOCK],
910-
operator=GrantControlOperator.OR,
911-
authentication_strength=None,
912-
),
913-
session_controls=SessionControls(
914-
persistent_browser=PersistentBrowser(
915-
is_enabled=False, mode="always"
916-
),
917-
sign_in_frequency=SignInFrequency(
918-
is_enabled=False,
919-
frequency=None,
920-
type=None,
921-
interval=SignInFrequencyInterval.EVERY_TIME,
922-
),
923-
),
924-
state=ConditionalAccessPolicyState.ENABLED,
925-
)
926-
}
927-
928-
check = entra_conditional_access_policy_block_elevated_insider_risk()
929-
result = check.execute()
930-
assert len(result) == 1
931-
assert result[0].status == "PASS"
932-
assert (
933-
result[0].status_extended
934-
== f"Conditional Access Policy '{display_name}' blocks access to all cloud apps for users with elevated insider risk."
935-
)
936-
assert (
937-
result[0].resource
938-
== entra_client.conditional_access_policies[policy_id].dict()
939-
)
940-
assert result[0].resource_name == display_name
941-
assert result[0].resource_id == policy_id
942-
assert result[0].location == "global"

0 commit comments

Comments
 (0)