Framework/Configurations/SVT/AAD/AAD.User.json

{
  "FeatureName": "User",
  "Reference": "aka.ms/azsktcp/user",
  "IsMaintenanceMode": false,
  "Controls": [
    {
      "ControlID": "AAD_User_DirSync_Setting_Should_Match_Tenant",
      "Description": "A user's dirsync-enabled setting must match the tenant level setting",
      "Id": "User110",
      "ControlSeverity": "High",
      "Automated": "Yes",
      "MethodName": "CheckUserDirSyncSetting",
      "Rationale": "When a tenant is setup with dir-sync, users are usually created on-premise and synchronized outbound. In such a case, seeing a user object with dirsync setting that does not match the tenant's setting is likely an anomaly and needs scrutiny.",
      "Recommendation": "Refer: TODO",
      "Tags": [
        "SDL",
        "TCP",
        "Automated",
        "AuthN"
      ],
      "Enabled": false
    },
    {
      "ControlID": "AAD_User_Do_Not_Disable_Password_Expiration",
      "Description": "Do not disable password expiration policy for users",
      "Id": "User120",
      "ControlSeverity": "High",
      "Automated": "Yes",
      "MethodName": "CheckPasswordExpiration",
      "Rationale": "Users with password expiration disabled represent a long term risk to the tenant in the event of password compromise. Ensuring that password expiration is enabled for everyone ensures that the window of attack is limited.",
      "Recommendation": "Refer: TODO",
      "Tags": [
        "SDL",
        "TCP",
        "Automated",
        "AuthN"
      ],
      "Enabled": false
    },
    {
      "ControlID": "AAD_User_Do_Not_Disable_Strong_Password",
      "Description": "Do not disable strong password policy for users",
      "Id": "User130",
      "ControlSeverity": "High",
      "Automated": "Yes",
      "MethodName": "CheckStrongPassword",
      "Rationale": "Strong passwords are harder to compromise. When strong passwords are disabled for a user, their account becomes vulnerable to various brute-force password guessing/cracking attacks.",
      "Recommendation": "Refer: TODO",
      "Tags": [
        "SDL",
        "TCP",
        "Automated",
        "AuthN"
      ],
      "Enabled": false
    }
]
}