Control: 1.1.1 Ensure Security Defaults is enabled on Azure Active Directory
Description
Security defaults in Azure Active Directory (Azure AD) make it easier to be secure and help protect your organization. Security defaults contain preconfigured security settings for common attacks.
Microsoft is making security defaults available to everyone. The goal is to ensure that all organizations have a basic level of security enabled at no extra cost. You may turn on security defaults in the Azure portal.
Security defaults provide secure default settings that we manage on behalf of organizations to keep customers safe until they are ready to manage their own identity security settings. For example, doing the following:
- Requiring all users and admins to register for MFA.
- Challenging users with MFA - mostly when they show up on a new device or app, but more often for critical roles and tasks.
- Disabling authentication from legacy authentication clients, which can’t do MFA.
Remediation
From Azure Portal
To enable security defaults in your directory:
- From Azure Home select the Portal Menu
- Browse to
Azure Active Directory > Properties - Select
Manage security defaults - Set the
Enable security defaults toggle to Yes - Select
Save
Please note that at this point of time, there is no Azure CLI or other API commands available to programmatically conduct security configuration for this recommendation.
Default Value
If your tenant was created on or after October 22, 2019, security defaults may already be enabled in your tenant.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v150_1_1_1Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v150_1_1_1 --shareSQL
This control uses a named query:
ad_manual_control