rules/findings/EntraID/SSPR/CIS3.0/eid-sspr-notify-users-on-password-reset-disabled.json
|
{
"args": [ ], "provider": "EntraID", "serviceType": "Identity Protection", "serviceName": "Microsoft Entra ID", "displayName": "Ensure that 'Notify users on password resets?' is set to 'Yes'", "description": "Ensure that users are notified on their primary and secondary emails on password resets.", "rationale": "User notification on password reset is a passive way of confirming password reset activity. It helps the user to recognize unauthorized password reset activities.", "impact": "Users will receive emails alerting them to password changes to both their primary and alternate emails.", "remediation": { "text": "###### From Azure Console\r\n\t\t\t\t\t\t1. Go to `Microsoft Entra ID`\r\n\t\t\t\t\t\t2. Go to `Users`\r\n\t\t\t\t\t\t3. Go to `Password reset`\r\n\t\t\t\t\t\t4. Go to `Notification`\r\n\t\t\t\t\t\t4. Click on `Notify users on password resets?` to `Yes`", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-how-it-works#notifications", "https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment", "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-6-define-identity-and-privileged-access-strategy" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "3.0.0", "reference": "2.10", "profile":"Level 1" } ], "level": "medium", "tags": [ "Microsoft 365 CIS benchmark", "CIS Microsoft Azure Foundations" ], "rule": { "path": "aad_password_reset_policy", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "notifyUsersOnPasswordReset", "ne", "true" ] ] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { }, "expandObject": null }, "table": null, "decorate": [ ], "emphasis": [ ], "actions": { "objectData": { "properties": [ "*" ], "expandObject": null, "limit": null }, "showGoToButton": false, "showModalButton": false, "directLink": null } }, "text": { "data": { "properties": { }, "expandObject": null }, "status": { "keyName": [ ], "message": "Notify users on password resets is set to NO", "defaultMessage": null }, "properties": { "resourceName": null, "resourceId": null, "resourceType": null }, "onlyStatus": false } }, "idSuffix": "eid_sspr_notify_users_on_password_reset_disabled", "notes": [ ], "categories": [ ] } |