Skip to content

Commit ab00c2d

Browse files
HugoPBritodanibarranqueroo
HugoPBrito
and
danibarranqueroo
authored
feat(m365): add entra_conditional_access_policy_block_elevated_insider_risk security check (#10234)
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
1 parent 765f9c7 commit ab00c2d

File tree

6 files changed

+991
-0
lines changed

6 files changed

+991
-0
lines changed

‎prowler/CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
1919
- CISA SCuBA Google Workspace Baselines compliance [(#10466)](https://github.com/prowler-cloud/prowler/pull/10466)
2020
- CIS Google Workspace Foundations Benchmark v1.3.0 compliance [(#10462)](https://github.com/prowler-cloud/prowler/pull/10462)
2121
- `entra_conditional_access_policy_device_registration_mfa_required` check and `entra_intune_enrollment_sign_in_frequency_every_time` enhancement for M365 provider [(#10222)](https://github.com/prowler-cloud/prowler/pull/10222)
22+
- `entra_conditional_access_policy_block_elevated_insider_risk` check for M365 provider [(#10234)](https://github.com/prowler-cloud/prowler/pull/10234)
2223

2324
### 🔄 Changed
2425

‎prowler/compliance/m365/iso27001_2022_m365.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,7 @@
121121
"defenderxdr_endpoint_privileged_user_exposed_credentials",
122122
"defender_identity_health_issues_no_open",
123123
"entra_admin_users_phishing_resistant_mfa_enabled",
124+
"entra_conditional_access_policy_block_elevated_insider_risk",
124125
"entra_conditional_access_policy_block_o365_elevated_insider_risk",
125126
"entra_identity_protection_sign_in_risk_enabled",
126127
"entra_identity_protection_user_risk_enabled"
@@ -683,6 +684,7 @@
683684
"entra_admin_portals_access_restriction",
684685
"entra_conditional_access_policy_approved_client_app_required_for_mobile",
685686
"entra_conditional_access_policy_app_enforced_restrictions",
687+
"entra_conditional_access_policy_block_elevated_insider_risk",
686688
"entra_conditional_access_policy_block_o365_elevated_insider_risk",
687689
"entra_policy_guest_users_access_restrictions",
688690
"sharepoint_external_sharing_restricted"
@@ -775,6 +777,7 @@
775777
"defender_safelinks_policy_enabled",
776778
"entra_admin_users_phishing_resistant_mfa_enabled",
777779
"entra_conditional_access_policy_app_enforced_restrictions",
780+
"entra_conditional_access_policy_block_elevated_insider_risk",
778781
"entra_conditional_access_policy_block_o365_elevated_insider_risk"
779782
]
780783
},

‎prowler/providers/m365/services/entra/entra_conditional_access_policy_block_elevated_insider_risk/__init__.py‎

Whitespace-only changes.

‎prowler/providers/m365/services/entra/entra_conditional_access_policy_block_elevated_insider_risk/entra_conditional_access_policy_block_elevated_insider_risk.metadata.json‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{
2+
"Provider": "m365",
3+
"CheckID": "entra_conditional_access_policy_block_elevated_insider_risk",
4+
"CheckTitle": "Conditional Access Policy blocks access for users with elevated insider risk",
5+
"CheckType": [],
6+
"ServiceName": "entra",
7+
"SubServiceName": "",
8+
"ResourceIdTemplate": "",
9+
"Severity": "medium",
10+
"ResourceType": "NotDefined",
11+
"ResourceGroup": "IAM",
12+
"Description": "This check verifies that at least one **enabled** Conditional Access policy **blocks access** to all cloud applications for users flagged with an **elevated insider risk** level by Microsoft Purview Insider Risk Management and Adaptive Protection.",
13+
"Risk": "Without blocking elevated insider risk users, compromised or malicious insiders retain **full access** to cloud applications. This enables data exfiltration, unauthorized modifications, and lateral movement, directly impacting **confidentiality** and **integrity**.",
14+
"RelatedUrl": "",
15+
"AdditionalURLs": [
16+
"https://learn.microsoft.com/en-us/purview/insider-risk-management-adaptive-protection",
17+
"https://learn.microsoft.com/en-us/entra/identity/conditional-access/how-to-policy-insider-risk"
18+
],
19+
"Remediation": {
20+
"Code": {
21+
"CLI": "",
22+
"NativeIaC": "",
23+
"Other": "1. In the Microsoft Entra admin center, go to Protection > Conditional Access > Policies.\n2. Click New policy.\n3. Under Users, select Include > All users.\n4. Under Target resources, select Include > All cloud apps.\n5. Under Conditions > Insider risk, select Configure > Yes, then check Elevated.\n6. Under Grant, select Block access.\n7. Set Enable policy to On and click Create.",
24+
"Terraform": ""
25+
},
26+
"Recommendation": {
27+
"Text": "Configure **Adaptive Protection** in Microsoft Purview to classify insider risk tiers, then create a Conditional Access policy that **blocks access** to all cloud apps for users with **elevated** risk. Only exclude dedicated break-glass accounts.",
28+
"Url": "https://hub.prowler.com/check/entra_conditional_access_policy_block_elevated_insider_risk"
29+
}
30+
},
31+
"Categories": [
32+
"identity-access",
33+
"e5"
34+
],
35+
"DependsOn": [],
36+
"RelatedTo": [],
37+
"Notes": "This check requires Microsoft 365 E5 with Microsoft Purview Insider Risk Management and Adaptive Protection configured. The insiderRiskLevels condition in Conditional Access evaluates the insider risk level assigned by Purview Adaptive Protection."
38+
}

‎prowler/providers/m365/services/entra/entra_conditional_access_policy_block_elevated_insider_risk/entra_conditional_access_policy_block_elevated_insider_risk.py‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
from prowler.lib.check.models import Check, CheckReportM365
2+
from prowler.providers.m365.services.entra.entra_client import entra_client
3+
from prowler.providers.m365.services.entra.entra_service import (
4+
ConditionalAccessGrantControl,
5+
ConditionalAccessPolicyState,
6+
InsiderRiskLevel,
7+
)
8+
9+
10+
class entra_conditional_access_policy_block_elevated_insider_risk(Check):
11+
"""Check if a Conditional Access policy blocks all cloud app access for elevated insider risk users.
12+
13+
This check verifies that at least one enabled Conditional Access policy
14+
blocks access to all cloud applications for users with an elevated insider
15+
risk level, as determined by Microsoft Purview Insider Risk Management
16+
and Adaptive Protection.
17+
18+
- PASS: An enabled CA policy blocks all cloud app access for elevated insider risk users.
19+
- FAIL: No enabled CA policy blocks broad cloud app access based on insider risk signals.
20+
"""
21+
22+
def execute(self) -> list[CheckReportM365]:
23+
"""Execute the check logic.
24+
25+
Returns:
26+
A list of reports containing the result of the check.
27+
"""
28+
findings = []
29+
report = CheckReportM365(
30+
metadata=self.metadata(),
31+
resource={},
32+
resource_name="Conditional Access Policies",
33+
resource_id="conditionalAccessPolicies",
34+
)
35+
report.status = "FAIL"
36+
report.status_extended = "No Conditional Access Policy blocks access for users with elevated insider risk."
37+
38+
for policy in entra_client.conditional_access_policies.values():
39+
if policy.state == ConditionalAccessPolicyState.DISABLED:
40+
continue
41+
42+
if not policy.conditions.application_conditions:
43+
continue
44+
45+
if "All" not in policy.conditions.user_conditions.included_users:
46+
continue
47+
48+
if (
49+
"All"
50+
not in policy.conditions.application_conditions.included_applications
51+
):
52+
continue
53+
54+
if (
55+
ConditionalAccessGrantControl.BLOCK
56+
not in policy.grant_controls.built_in_controls
57+
):
58+
continue
59+
60+
if policy.conditions.insider_risk_levels is None:
61+
report = CheckReportM365(
62+
metadata=self.metadata(),
63+
resource=policy,
64+
resource_name=policy.display_name,
65+
resource_id=policy.id,
66+
)
67+
report.status = "FAIL"
68+
if policy.state == ConditionalAccessPolicyState.ENABLED_FOR_REPORTING:
69+
report.status_extended = f"Conditional Access Policy {policy.display_name} is configured in report-only mode to block all cloud apps and Microsoft Purview Adaptive Protection is not providing insider risk signals."
70+
else:
71+
report.status_extended = f"Conditional Access Policy {policy.display_name} is configured to block all cloud apps and Microsoft Purview Adaptive Protection is not providing insider risk signals."
72+
continue
73+
74+
if policy.conditions.insider_risk_levels != InsiderRiskLevel.ELEVATED:
75+
continue
76+
77+
report = CheckReportM365(
78+
metadata=self.metadata(),
79+
resource=policy,
80+
resource_name=policy.display_name,
81+
resource_id=policy.id,
82+
)
83+
84+
if policy.state == ConditionalAccessPolicyState.ENABLED_FOR_REPORTING:
85+
report.status = "FAIL"
86+
report.status_extended = f"Conditional Access Policy {policy.display_name} reports blocking all cloud apps for elevated insider risk users but does not enforce it."
87+
else:
88+
report.status = "PASS"
89+
report.status_extended = f"Conditional Access Policy {policy.display_name} blocks access to all cloud apps for users with elevated insider risk."
90+
break
91+
92+
findings.append(report)
93+
return findings

0 commit comments

Comments
 (0)