Control: 5.1.1 Ensure that 'security defaults' is enabled in Microsoft Entra ID
Description
[IMPORTANT - Please read the section overview: If your organization pays for Microsoft Entra ID licensing (included in Microsoft 365 E3, E5, F5, or Business Premium, and EM&S E3 or E5 licenses) and CAN use Conditional Access, ignore the recommendations in this section and proceed to the Conditional Access section.]
Security defaults in Microsoft Entra ID make it easier to be secure and help protect your organization. Security defaults contain preconfigured security settings for common attacks.
Security defaults is available to everyone. The goal is to ensure that all organizations have a basic level of security enabled at no extra cost. You may turn on security defaults in the Azure portal.
Remediation
Remediate from Azure Portal
To enable security defaults in your directory:
- From Azure Home select the Portal Menu.
- Browse to
Microsoft Entra ID>Properties. - Select
Manage security defaults. - Under
Security defaults, selectEnabled (recommended). - Select
Save.
Remediate from Powershell
Connect-MgGraph -Scopes "Policy.ReadWrite.ApplicationConfiguration"Update-MgPolicyIdentitySecurityDefaultEnforcementPolicy -IsEnabled $true(Get-MgPolicyIdentitySecurityDefaultEnforcementPolicy).IsEnabled
Remediate from Azure CLI
az rest --method patch --url'https://graph.microsoft.com/v1.0/policies/identitySecurityDefaultsEnforcementPolicy' --body '{"isEnabled":true}'az rest --method get --url'https://graph.microsoft.com/v1.0/policies/identitySecurityDefaultsEnforcementPolicy' --query "isEnabled"
Default Value:
If your tenant was created on or after October 22, 2019, security defaults may already be enabled in your tenant.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v500_5_1_1Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v500_5_1_1 --shareSQL
This control uses a named query:
with distinct_tenant as ( select distinct tenant_id, subscription_id, _ctx from azure_tenant)select p.id as resource, case when (p.is_enabled)::bool then 'ok' else 'alarm' end as status, case when (p.is_enabled)::bool then p.tenant_id || ' security defaults enabled.' else p.tenant_id || ' security defaults disabled.' end as reason, t.tenant_id from distinct_tenant as t, azuread_security_defaults_policy as p;