Rules/ID-005.user-consent-restricted.psd1
|
@{ Id = 'ID-005' Title = 'User consent for applications is restricted' Area = 'AuthorizationPolicy' Severity = 'Medium' References = @( 'CIS Microsoft 365 Foundations Benchmark (user consent to apps)' 'https://learn.microsoft.com/entra/identity/enterprise-apps/configure-user-consent' ) Rationale = 'Unrestricted user consent is the primary vector for illicit consent-grant (OAuth phishing) attacks - a malicious app gets durable API access without stealing a password.' Remediation = 'Restrict user consent to verified publishers and low-impact permissions, or disable it and use admin consent workflow.' Test = { param($Snapshot) $authPolicy = $Snapshot.AuthorizationPolicy.authorizationPolicy if (-not $authPolicy -or -not $authPolicy.PSObject.Properties['defaultUserRolePermissions'] -or -not $authPolicy.defaultUserRolePermissions) { return New-TLRuleResult -Status Manual -Evidence 'defaultUserRolePermissions not present in the snapshot.' } $grantPolicies = @($authPolicy.defaultUserRolePermissions.permissionGrantPoliciesAssigned) $legacy = @($grantPolicies | Where-Object { $_ -match 'microsoft-user-default-legacy' }) if ($legacy.Count -gt 0) { New-TLRuleResult -Status Fail -Evidence 'Users may consent to any application for any permission (microsoft-user-default-legacy).' } else { New-TLRuleResult -Status Pass -Evidence ("User consent policy: {0}" -f $(if (@($grantPolicies).Count -gt 0) { $grantPolicies -join ', ' } else { 'consent disabled' })) } } } |