rules/findings/m365/microsoft_intune/ms-intune-devices-enrollment-personal-devices-not-blocked.json
|
{
"args": [ ], "provider": "Microsoft365", "serviceType": "Intune", "serviceName": "Microsoft 365", "displayName": "Ensure device enrollment for personally owned devices is blocked by default", "description": "Device enrollment restrictions let you restrict devices from enrolling in Intune based on certain device attributes such as device limit, device platform, OS Version, manufacturer or device ownership (Personally owned devices).\n\nThe recommended state is to `Block` personally owned devices from enrollment.", "rationale": "Restricting the enrollment of personally owned devices prevents attackers who have bypassed other controls from registering a new device to gain an additional foothold, further hiding or obscuring their activities.", "impact": null, "remediation": { "text": "\r\n\t\t\t###### To remediate using the UI: \r\n\t\t\t1. Navigate to Microsoft Intune admin center https://intune.microsoft.com/ \r\n\t\t\t2. Select Devices and then under Device onboarding click Enrollment \r\n\t\t\t3. Under Enrollment options select Device platform restriction. \r\n\t\t\t4. Inspect the policies listed under Device type restrictions \r\n\t\t\t\t* For the Default priority policy, click All Users. \r\n\t\t\t\t* Select Properties. \r\n\t\t\t5. Click Edit to change Platform settings. \r\n\t\t\t6. In the Personally owned column set each platform to Block. \r\n\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/intune/intune-service/protect/device-compliance-get-started" ], "compliance": [ { "name": "CIS Microsoft 365 Foundations Benchmark", "version": "6.1.0", "reference": "4.2", "profile": [ "E3 Level 2", "E5 Level 2" ] } ], "level": "medium", "tags": [ ], "rule": { "path": "intune_device_enrollment_config", "subPath": null, "selectCondition":{ "conditions": [ [ "id", "match", "DefaultPlatformRestrictions" ], [ "priority", "eq", "0" ] ], "operator": "and" }, "query": [ { "filter": [ { "conditions": [ [ "windowsRestriction.personalDeviceEnrollmentBlocked", "eq", "False" ], [ "iosRestriction.personalDeviceEnrollmentBlocked", "eq", "False" ], [ "androidRestriction.personalDeviceEnrollmentBlocked", "eq", "False" ], [ "androidForWorkRestriction.personalDeviceEnrollmentBlocked", "eq", "False" ], [ "macOSRestriction.personalDeviceEnrollmentBlocked", "eq", "False" ] ], "operator":"or" } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "displayName": "displayName", "description": "description", "windowsRestriction.personalDeviceEnrollmentBlocked": "Windows Personal Device Blocked", "iosRestriction.personalDeviceEnrollmentBlocked": "IOS Personal Device Blocked", "androidRestriction.personalDeviceEnrollmentBlocked": "Android Personal Device Blocked", "androidForWorkRestriction.personalDeviceEnrollmentBlocked": "Android For Work Personal Device Blocked", "macOSRestriction.personalDeviceEnrollmentBlocked": "MacOS Personal Device Blocked" }, "expandObject": null }, "table": "asList", "decorate": [ ], "emphasis": [ ], "actions": { "objectData": { "properties": [ ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "displayName": "displayName", "description": "description", "windowsRestriction.personalDeviceEnrollmentBlocked": "Windows Personal Device Blocked", "iosRestriction.personalDeviceEnrollmentBlocked": "IOS Personal Device Blocked", "androidRestriction.personalDeviceEnrollmentBlocked": "Android Personal Device Blocked", "androidForWorkRestriction.personalDeviceEnrollmentBlocked": "Android For Work Personal Device Blocked", "macOSRestriction.personalDeviceEnrollmentBlocked": "MacOS Personal Device Blocked" }, "expandObject": null }, "status": { "keyName": [ ], "message": "Ensure device enrollment for personally owned devices is blocked by default", "defaultMessage": "Ensure device enrollment for personally owned devices is blocked by default" }, "properties": { "resourceName": "displayName", "resourceId": "id", "resourceType": "deviceEnrollmentPlatformRestrictionsConfiguration" }, "onlyStatus": false } }, "idSuffix": "intune_personally_owned_devices_not_blocked", "notes": [ ], "categories": [ ], "immutable_properties": [ "id" ], "id": "microsoft365_2157" } |