Devolutions.CIEM

Cloud Infrastructure Entitlement Management (CIEM) module for Azure identity and access security checks. Provides 46 identity-focused checks for Entra ID, IAM/RBAC, KeyVault, and Storage services.

Minimum PowerShell version

7.4

Installation Options

Owners

• adbertram

Copyright

(c) 2025 Devolutions Inc. All rights reserved.

Package Details

FileList

• Devolutions.CIEM.nuspec
• AzureChecks.schema.json
• Public\Get-CIEMAuthenticationContext.ps1
• Private\Test-AzureChecksSchema.ps1
• Private\Get-AzureAuthContext.ps1
• Private\Get-SupportedProvider.ps1
• Checks\Azure\Test-StorageDefaultNetworkAccessRuleIsDenied.ps1
• Checks\Azure\Test-KeyvaultKeyRotationEnabled.ps1
• Checks\Azure\Test-KeyvaultPublicNetworkAccessDisabled.ps1
• Checks\Azure\Test-EntraPolicyEnsureDefaultUserCannotCreateTenant.ps1
• Checks\Azure\Test-KeyvaultRbacEnabled.ps1
• Checks\Azure\Test-StorageEnsureAzureServicesAreTrustedToAccessIsEnabled.ps1
• Checks\Azure\Test-EntraPolicyDefaultUserCannotCreateSecurityGroup.ps1
• config.json
• Public\Sync-ProwlerCheck.ps1
• Private\Test-AzureConnection.ps1
• Private\Convert-ProwlerCheck.ps1
• Private\Invoke-AzureApi.ps1
• Checks\Azure\Test-KeyvaultPrivateEndpoint.ps1
• Checks\Azure\Test-KeyvaultLoggingEnabled.ps1
• Checks\Azure\Test-StorageInfrastructureEncryptionIsEnabled.ps1
• Checks\Azure\Test-EntraUserCannotCreateMicrosoft365Group.ps1
• Checks\Azure\Test-EntraConditionalAccessPolicyRequireMfaForManagementApi.ps1
• Checks\Azure\Test-EntraPolicyGuestUserAccessRestriction.ps1
• Checks\Azure\Test-EntraTrustedNamedLocationExist.ps1
• Devolutions.CIEM.psm1
• Public\Get-CIEMCheck.ps1
• Private\New-CIEMFinding.ps1
• Private\Test-KeyVaultItemExpiration.ps1
• Private\Initialize-StorageService.ps1
• Checks\Azure\Test-KeyvaultRbacSecretExpirationSet.ps1
• Checks\Azure\Test-IamSubscriptionRolesOwnerCustomNotCreated.ps1
• Checks\Azure\Test-StorageDefaultToEntraAuthorizationEnabled.ps1
• Checks\Azure\Test-StorageEnsureSoftDeleteIsEnabled.ps1
• Checks\Azure\Test-StorageKeyRotation90Day.ps1
• Checks\Azure\Test-StorageSecureTransferRequiredIsEnabled.ps1
• Checks\Azure\Test-KeyvaultRbacKeyExpirationSet.ps1
• Devolutions.CIEM.psd1
• Public\Get-ProwlerCheck.ps1
• Private\Test-EntraAuthorizationPolicyBooleanSetting.ps1
• Private\Get-CheckMetadata.ps1
• Checks\Azure\Test-IamRoleUserAccessAdminRestricted.ps1
• Checks\Azure\Test-StorageEnsureMinimumTlsVersion12.ps1
• Checks\Azure\Test-KeyvaultKeyExpirationSetInNonRbac.ps1
• Checks\Azure\Test-StorageEnsureEncryptionWithCustomerManagedKey.ps1
• Checks\Azure\Test-EntraPolicyEnsureDefaultUserCannotCreateApp.ps1
• Checks\Azure\Test-KeyvaultRecoverable.ps1
• Checks\Azure\Test-EntraUserWithVmAccessHasMfa.ps1
• Checks\Azure\Test-StorageCrossTenantReplicationDisabled.ps1
• AzureChecks.json
• Public\Invoke-CIEMScan.ps1
• Private\Initialize-IAMService.ps1
• Private\Test-GitRemote.ps1
• Checks\Azure\Test-StorageBlobPublicAccessLevelIsDisabled.ps1
• Checks\Azure\Test-EntraNonPrivilegedUserHasMfa.ps1
• Checks\Azure\Test-StorageGeoRedundantEnabled.ps1
• Checks\Azure\Test-KeyvaultNonRbacSecretExpirationSet.ps1
• Checks\Azure\Test-StorageEnsureFileSharesSoftDeleteIsEnabled.ps1
• Checks\Azure\Test-EntraPolicyGuestInviteOnlyForAdminRole.ps1
• Checks\Azure\Test-StorageAccountKeyAccessDisabled.ps1
• Checks\Azure\Test-EntraPolicyRestrictUserConsentForApp.ps1
• Private\Get-AllGraphPage.ps1
• Private\Initialize-KeyVaultService.ps1
• Private\Get-CIEMConfig.ps1
• Checks\Azure\Test-StorageSmbProtocolVersionIsLatest.ps1
• Checks\Azure\Test-EntraPrivilegedUserHasMfa.ps1
• Checks\Azure\Test-StorageSmbChannelEncryptionWithSecureAlgorithm.ps1
• Checks\Azure\Test-StorageBlobVersioningIsEnabled.ps1
• Checks\Azure\Test-IamCustomRoleHasPermissionToAdministerResourceLock.ps1
• Checks\Azure\Test-EntraSecurityDefaultsEnabled.ps1
• Checks\Azure\Test-StorageEnsurePrivateEndpointInStorageAccount.ps1
• apps\DevolutionsCIEM\app.ps1
• Public\Get-CIEMProvider.ps1
• Private\Initialize-EntraService.ps1
• Private\Test-StorageAccountProperty.ps1
• Private\Set-CIEMConfig.ps1
• Checks\Azure\Test-EntraPolicyUserConsentForVerifiedApp.ps1

Version History