Rules/STALE-001.no-stale-enabled-users.psd1
|
@{ Id = 'STALE-001' Title = 'No enabled user has been inactive beyond the stale threshold' Area = 'StaleAccounts' Severity = 'Medium' References = @( 'CIS Microsoft 365 Foundations Benchmark (inactive accounts)' 'https://learn.microsoft.com/entra/identity/monitoring-health/howto-manage-inactive-user-accounts' ) Rationale = 'Enabled accounts nobody uses are unwatched attack surface: credentials age, MFA prompts annoy no one, and compromise goes unnoticed.' Remediation = 'Review the inactive accounts: disable, delete, or document why they must stay (service accounts belong in a break-glass/service inventory).' Test = { param($Snapshot) $staleData = $Snapshot.StaleAccounts $staleCount = [int]$staleData.summary.staleUserCount if ($staleCount -eq 0) { New-TLRuleResult -Status Pass -Evidence ("No stale enabled users among {0} evaluated (threshold {1} days)." -f $staleData.summary.totalEvaluated, $staleData.thresholdDays) } else { $examples = @($staleData.users | Where-Object { $_._tlStale } | Select-Object -First 10 | ForEach-Object { $_.userPrincipalName }) New-TLRuleResult -Status Fail -Evidence (@("{0} enabled user(s) inactive for more than {1} days." -f $staleCount, $staleData.thresholdDays) + $examples) } } } |