Devolutions.CIEM
0.2.3
Cloud Infrastructure Entitlement Management (CIEM) module for Azure identity and access security checks. Provides 46 identity-focused checks for Entra ID, IAM/RBAC, KeyVault, and Storage services.
Minimum PowerShell version
7.4
Installation Options
Owners
Copyright
(c) 2025 Devolutions Inc. All rights reserved.
Package Details
Author(s)
- Adam Bertram
Tags
Azure CIEM Security Identity IAM Entra RBAC Compliance PowerShellUniversal app
Functions
Get-CIEMAuthenticationContext Get-CIEMCheck Get-CIEMProvider Get-ProwlerCheck Invoke-CIEMScan New-DevolutionsCIEMApp Sync-ProwlerCheck
PSEditions
Dependencies
This module has no dependencies.
Release Notes
## 0.2.3 - Az.Accounts Auto-Install
- Auto-installs Az.Accounts when module loads if not present
- Removed RequiredModules dependency (PSU Gallery does not auto-install dependencies)
- Removed runtime checks from individual functions (handled at module load)
- Module now works out-of-the-box when installed from PSU Gallery
## 0.2.2 - PSU App Load Fix
- Removed Az.Accounts from RequiredModules to fix PSU app loading
- Az.Accounts was preventing module import on servers without Azure modules
- Added runtime module checks to Get-CIEMAuthenticationContext and Invoke-CIEMScan
- PSU app now loads without Azure modules; scans require Az.Accounts at runtime
## 0.2.0 - PSU App Integration
- Added New-DevolutionsCIEMApp function for PSU module-based discovery
- Switched from -FilePath to -Module/-Command pattern for PSU Gallery compatibility
- App now auto-discovers when module is installed to PSU Modules directory
## 0.1.0 - Initial Release
- 46 Azure identity-focused security checks
- Entra ID: 15 checks (MFA, conditional access, security defaults, etc.)
- IAM/RBAC: 3 checks (custom roles, permissions)
- KeyVault: 10 checks (access policies, RBAC, expiration)
- Storage: 18 checks (access controls, encryption, network rules)
- Parallel check execution with ForEach-Object -Parallel
- Auto-detect Azure authentication (Managed Identity, CLI, Interactive)
FileList
- Devolutions.CIEM.nuspec
- AzureChecks.schema.json
- Public\Get-CIEMAuthenticationContext.ps1
- Private\Test-AzureChecksSchema.ps1
- Private\Get-AzureAuthContext.ps1
- Private\Get-SupportedProvider.ps1
- Checks\Azure\Test-EntraPolicyUserConsentForVerifiedApp.ps1
- Checks\Azure\Test-EntraPrivilegedUserHasMfa.ps1
- Checks\Azure\Test-StorageSmbChannelEncryptionWithSecureAlgorithm.ps1
- Checks\Azure\Test-StorageBlobVersioningIsEnabled.ps1
- Checks\Azure\Test-IamCustomRoleHasPermissionToAdministerResourceLock.ps1
- Checks\Azure\Test-EntraSecurityDefaultsEnabled.ps1
- Checks\Azure\Test-StorageEnsurePrivateEndpointInStorageAccount.ps1
- config.json
- Public\Sync-ProwlerCheck.ps1
- Private\Test-AzureConnection.ps1
- Private\Convert-ProwlerCheck.ps1
- Private\Invoke-AzureApi.ps1
- Checks\Azure\Test-StorageDefaultNetworkAccessRuleIsDenied.ps1
- Checks\Azure\Test-KeyvaultKeyRotationEnabled.ps1
- Checks\Azure\Test-KeyvaultPublicNetworkAccessDisabled.ps1
- Checks\Azure\Test-EntraPolicyEnsureDefaultUserCannotCreateTenant.ps1
- Checks\Azure\Test-KeyvaultRbacEnabled.ps1
- Checks\Azure\Test-StorageEnsureAzureServicesAreTrustedToAccessIsEnabled.ps1
- Checks\Azure\Test-EntraPolicyDefaultUserCannotCreateSecurityGroup.ps1
- Devolutions.CIEM.psm1
- Public\Get-CIEMCheck.ps1
- Private\New-CIEMFinding.ps1
- Private\Test-KeyVaultItemExpiration.ps1
- Private\Initialize-StorageService.ps1
- Checks\Azure\Test-KeyvaultPrivateEndpoint.ps1
- Checks\Azure\Test-KeyvaultLoggingEnabled.ps1
- Checks\Azure\Test-StorageInfrastructureEncryptionIsEnabled.ps1
- Checks\Azure\Test-EntraUserCannotCreateMicrosoft365Group.ps1
- Checks\Azure\Test-EntraConditionalAccessPolicyRequireMfaForManagementApi.ps1
- Checks\Azure\Test-EntraPolicyGuestUserAccessRestriction.ps1
- Checks\Azure\Test-EntraTrustedNamedLocationExist.ps1
- Devolutions.CIEM.psd1
- Public\Get-ProwlerCheck.ps1
- Private\Test-EntraAuthorizationPolicyBooleanSetting.ps1
- Private\Get-CheckMetadata.ps1
- Checks\Azure\Test-IamRoleUserAccessAdminRestricted.ps1
- Checks\Azure\Test-KeyvaultRbacSecretExpirationSet.ps1
- Checks\Azure\Test-IamSubscriptionRolesOwnerCustomNotCreated.ps1
- Checks\Azure\Test-StorageDefaultToEntraAuthorizationEnabled.ps1
- Checks\Azure\Test-StorageEnsureSoftDeleteIsEnabled.ps1
- Checks\Azure\Test-StorageKeyRotation90Day.ps1
- Checks\Azure\Test-StorageSecureTransferRequiredIsEnabled.ps1
- Checks\Azure\Test-KeyvaultRbacKeyExpirationSet.ps1
- AzureChecks.json
- Public\Invoke-CIEMScan.ps1
- Private\Initialize-IAMService.ps1
- Private\Test-GitRemote.ps1
- Checks\Azure\Test-StorageBlobPublicAccessLevelIsDisabled.ps1
- Checks\Azure\Test-StorageEnsureMinimumTlsVersion12.ps1
- Checks\Azure\Test-KeyvaultKeyExpirationSetInNonRbac.ps1
- Checks\Azure\Test-StorageEnsureEncryptionWithCustomerManagedKey.ps1
- Checks\Azure\Test-EntraPolicyEnsureDefaultUserCannotCreateApp.ps1
- Checks\Azure\Test-KeyvaultRecoverable.ps1
- Checks\Azure\Test-EntraUserWithVmAccessHasMfa.ps1
- Checks\Azure\Test-StorageCrossTenantReplicationDisabled.ps1
- Private\Get-AllGraphPage.ps1
- Private\Initialize-KeyVaultService.ps1
- Private\Get-CIEMConfig.ps1
- Checks\Azure\Test-StorageSmbProtocolVersionIsLatest.ps1
- Checks\Azure\Test-EntraNonPrivilegedUserHasMfa.ps1
- Checks\Azure\Test-StorageGeoRedundantEnabled.ps1
- Checks\Azure\Test-KeyvaultNonRbacSecretExpirationSet.ps1
- Checks\Azure\Test-StorageEnsureFileSharesSoftDeleteIsEnabled.ps1
- Checks\Azure\Test-EntraPolicyGuestInviteOnlyForAdminRole.ps1
- Checks\Azure\Test-StorageAccountKeyAccessDisabled.ps1
- Checks\Azure\Test-EntraPolicyRestrictUserConsentForApp.ps1
- Public\Get-CIEMProvider.ps1
- Private\Initialize-EntraService.ps1
- Private\Test-StorageAccountProperty.ps1
- Private\Set-CIEMConfig.ps1
Version History
| Version | Downloads | Last updated |
|---|---|---|
| 0.2.60 | 4 | 1/30/2026 |
| 0.2.59 | 4 | 1/30/2026 |
| 0.2.58 | 3 | 1/30/2026 |
| 0.2.57 | 3 | 1/30/2026 |
| 0.2.56 | 3 | 1/30/2026 |
| 0.2.55 | 3 | 1/30/2026 |
| 0.2.54 | 4 | 1/30/2026 |
| 0.2.53 | 3 | 1/30/2026 |
| 0.2.52 | 3 | 1/30/2026 |
| 0.2.51 | 3 | 1/30/2026 |
| 0.2.50 | 3 | 1/30/2026 |
| 0.2.49 | 3 | 1/30/2026 |
| 0.2.48 | 3 | 1/30/2026 |
| 0.2.47 | 4 | 1/30/2026 |
| 0.2.46 | 3 | 1/30/2026 |
| 0.2.45 | 3 | 1/30/2026 |
| 0.2.44 | 4 | 1/30/2026 |
| 0.2.43 | 3 | 1/30/2026 |
| 0.2.42 | 3 | 1/30/2026 |
| 0.2.41 | 5 | 1/29/2026 |
| 0.2.40 | 4 | 1/29/2026 |
| 0.2.39 | 4 | 1/29/2026 |
| 0.2.38 | 4 | 1/29/2026 |
| 0.2.37 | 4 | 1/29/2026 |
| 0.2.36 | 5 | 1/29/2026 |
| 0.2.35 | 3 | 1/29/2026 |
| 0.2.34 | 4 | 1/29/2026 |
| 0.2.33 | 3 | 1/29/2026 |
| 0.2.32 | 4 | 1/29/2026 |
| 0.2.31 | 4 | 1/29/2026 |
| 0.2.30 | 4 | 1/29/2026 |
| 0.2.29 | 5 | 1/29/2026 |
| 0.2.28 | 3 | 1/29/2026 |
| 0.2.27 | 5 | 1/29/2026 |
| 0.2.26 | 5 | 1/29/2026 |
| 0.2.24 | 4 | 1/29/2026 |
| 0.2.23 | 5 | 1/29/2026 |
| 0.2.22 | 3 | 1/29/2026 |
| 0.2.21 | 6 | 1/28/2026 |
| 0.2.18 | 4 | 1/28/2026 |
| 0.2.17 | 5 | 1/28/2026 |
| 0.2.15 | 4 | 1/28/2026 |
| 0.2.13 | 5 | 1/28/2026 |
| 0.2.11 | 5 | 1/28/2026 |
| 0.2.10 | 3 | 1/28/2026 |
| 0.2.9 | 4 | 1/28/2026 |
| 0.2.7 | 6 | 1/27/2026 |
| 0.2.5 | 4 | 1/27/2026 |
| 0.2.4 | 7 | 1/27/2026 |
| 0.2.3 (current version) | 4 | 1/27/2026 |
| 0.2.1 | 6 | 1/27/2026 |
| 0.2.0 | 4 | 1/27/2026 |
| 0.1.1 | 5 | 1/27/2026 |
| 0.1.0-alpha | 3 | 1/27/2026 |