Rules/XT-001.no-automatic-consent-defaults.psd1
|
@{ Id = 'XT-001' Title = 'Cross-tenant automatic user consent is not enabled by default' Area = 'CrossTenantAccess' Severity = 'Medium' References = @( 'https://learn.microsoft.com/entra/external-id/cross-tenant-access-settings-b2b-collaboration' ) Rationale = 'Automatic consent redemption belongs on explicitly configured partner tenants (cross-tenant sync). Enabled as the DEFAULT, every tenant on earth gets frictionless redemption into yours.' Remediation = 'Disable inbound/outbound automatic user consent in the cross-tenant access defaults; enable it per partner configuration where cross-tenant sync is intended.' Test = { param($Snapshot) $defaultConfiguration = $Snapshot.CrossTenantAccess.default if (-not $defaultConfiguration -or -not $defaultConfiguration.PSObject.Properties['automaticUserConsentSettings']) { return New-TLRuleResult -Status Manual -Evidence 'Cross-tenant default configuration not present in the snapshot.' } $consentSettings = $defaultConfiguration.automaticUserConsentSettings $inbound = [bool]($consentSettings.PSObject.Properties['inboundAllowed'] -and $consentSettings.inboundAllowed) $outbound = [bool]($consentSettings.PSObject.Properties['outboundAllowed'] -and $consentSettings.outboundAllowed) if ($inbound -or $outbound) { $directions = @() if ($inbound) { $directions += 'inbound' } if ($outbound) { $directions += 'outbound' } New-TLRuleResult -Status Fail -Evidence ("Automatic user consent enabled by default: {0}." -f ($directions -join ' + ')) } else { New-TLRuleResult -Status Pass -Evidence 'Automatic user consent is disabled in the cross-tenant defaults.' } } } |