Benchmark: 1 Identity and Access Management
Overview
This section covers security recommendations to set identity and access management policies on an Azure Subscription. Identity and Access Management policies are the first step towards a defense-in-depth approach to securing an Azure Cloud Platform environment.
Many of the recommendations from this section are marked as "Manual" while the existing Azure CLI and Azure AD PowerShell support through the Azure AD Graph are being depreciated. It is now recommended to use the new Microsoft Graph in replacement of Azure AD Graph for PowerShell and API level access. From a security posture standpoint, these recommendations are still very important and should not be discounted because they are "Manual." As automation capability using Rest API is developed for this Benchmark, the related recommendations will be updated with the respective audit and remediation steps and changed to an "automated" assessment status.
If any problems are encountered running Azure CLI or PowerShell methodologies, please refer to the Overview for this benchmark where you will find additional detail on permission and required cmdlets.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/steampipe-mod-azure-complianceStart the Powerpipe server:
steampipe service startpowerpipe serverOpen http://localhost:9033 in your browser and select 1 Identity and Access Management.
Run this benchmark in your terminal:
powerpipe benchmark run azure_compliance.benchmark.cis_v210_1Snapshot and share results via Turbot Pipes:
powerpipe benchmark run azure_compliance.benchmark.cis_v210_1 --shareBenchmarks
Controls
- 1.3 Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes'
- 1.4 Ensure Guest Users Are Reviewed on a Regular Basis
- 1.5 Ensure That 'Number of methods required to reset' is set to '2'
- 1.6 Ensure that a Custom Bad Password List is set to 'Enforce' for your Organization
- 1.7 Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to '0'
- 1.8 Ensure that 'Notify users on password resets?' is set to 'Yes'
- 1.9 Ensure That 'Notify all admins when other admins reset their password?' is set to 'Yes'
- 1.10 Ensure 'User consent for applications' is set to 'Do not allow user consent'
- 1.11 Ensure 'User consent for applications' Is Set To 'Allow for Verified Publishers'
- 1.12 Ensure that 'Users can add gallery apps to My Apps' is set to 'No'
- 1.13 Ensure That 'Users Can Register Applications' Is Set to 'No'
- 1.14 Ensure That 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects'
- 1.15 Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles can invite guest users'
- 1.16 Ensure That 'Restrict access to Microsoft Entra admin center' is Set to 'Yes'
- 1.17 Ensure that 'Restrict user ability to access groups features in the Access Pane' is Set to 'Yes'
- 1.18 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'
- 1.19 Ensure that 'Owners can manage group membership requests in the Access Panel' is set to 'No'
- 1.20 Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'
- 1.21 Ensure that 'Require Multi-Factor Authentication to register or join devices with Microsoft Entra ID' is set to 'Yes'
- 1.22 Ensure That No Custom Subscription Administrator Roles Exist
- 1.23 Ensure a Custom Role is Assigned Permissions for Administering Resource Locks
- 1.24 Ensure That `Subscription leaving Microsoft Entra ID directory` and `Subscription entering Microsoft Entra ID directory` Is Set To 'Permit No One'
- 1.25 Ensure fewer than 5 users have global administrator assignment