rules/findings/EntraID/SecurityDefaults/CIS3.0/entra-security-defaults-enabled.json
|
{
"args": [ ], "provider": "EntraID", "serviceType": "General", "serviceName": "Microsoft Entra ID", "displayName": "Ensure Security Defaults is enabled on Microsoft Entra ID", "description": "Security defaults in Microsoft Entra ID (Azure Active Directory) make it easier to be secure and help protect your organization. Security defaults contain preconfigured security settings for common attacks.\r\n\t\tMicrosoft is making security defaults available to everyone. The goal is to ensure that all organizations have a basic level of security-enabled at no extra cost. You turn on security defaults in the Azure portal.", "rationale": "Security defaults provide secure default settings that we manage on behalf of organizations to keep customers safe until they are ready to manage their own identity security settings.\r\n\r\n\t\tFor example doing the following:\r\n\r\n\t\t\t* Requiring all users and admins to register for MFA.\r\n\t\t\t* Challenging users with MFA - mostly when they show up on a new device or app, but more often for critical roles and tasks.\r\n\t\t\t* Disabling authentication from legacy authentication clients, which can’t do MFA.", "impact": "Enabling security defaults may negatively impact the functionality of other Microsoft services, such as MS365. This recommendation should be implemented initially and then may be overridden by other service/product specific CIS Benchmarks.", "remediation": { "text": "###### From Azure Console\r\n\t\t1. Sign in to Azure portal as a security administrator, Conditional Access administrator, or global administrator.\r\n\t\t2. Browse to Microsoft Entra ID \u003e Properties.\r\n\t\t3. Select Manage security defaults.\r\n\t\t4. Set the Enable security defaults toggle to Yes.\r\n\t\t5. Select Save.", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/users-default-permissions", "http://www.rebeladmin.com/2019/04/step-step-guide-restrict-azure-ad-administration-portal/", "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults", "https://techcommunity.microsoft.com/t5/azure-active-directory-identity/introducing-security-defaults/ba-p/1061414" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations Benchmark", "version": "3.0.0", "reference": "2.1.1", "profile": "Level 1" } ], "level": "medium", "tags": [ ], "rule": { "path": "aad_security_default_status", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "securityDefaultsEnabled", "eq", "False" ] ] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { }, "expandObject": null }, "table": null, "decorate": [ ], "emphasis": [ ], "actions": { "objectData": { "properties": [ "*" ], "expandObject": null, "limit": null }, "showGoToButton": false, "showModalButton": false, "directLink": null } }, "text": { "data": { "properties": { }, "expandObject": null }, "status": { "keyName": [ ], "message": "Security Defaults is disabled", "defaultMessage": null }, "properties": { "resourceName": null, "resourceId": null, "resourceType": null }, "onlyStatus": false } }, "idSuffix": "eid_sbd_disabled", "notes": [ ], "categories": [ ] } |