33 lines
1.5 KiB
YAML
33 lines
1.5 KiB
YAML
id: azure-entra-id-guest-users-unmonitored
|
|
info:
|
|
name: Azure Entra ID Guest Users Unmonitored
|
|
author: princechaddha
|
|
severity: medium
|
|
description: |
|
|
For a Microsoft Azure business-to-business (B2B) collaboration, each Microsoft Entra ID guest user needs to be associated with a business owner or business process. Ensure that there are no unassociated Microsoft Entra ID guest users within your Microsoft Azure account when there is no need for B2B collaboration.
|
|
impact: |
|
|
Presence of unmonitored Microsoft Entra ID guest users can lead to unauthorized access and potential security risks within the Azure environment.
|
|
remediation: |
|
|
Regularly review and monitor guest users in Microsoft Entra ID to ensure each is associated with a business owner or process. Remove any unnecessary guest user accounts.
|
|
reference:
|
|
- https://docs.microsoft.com/en-us/azure/active-directory/external-identities/
|
|
tags: cloud,devops,azure,microsoft,entra-id,azure-cloud-config
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az ad user list --query "[?userType=='Guest']" --output json
|
|
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- '"userType": "Guest"'
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- '"Azure Account han an Entra ID guest user Microsoft Entra ID"'
|
|
# digest: 4b0a00483046022100b8a6a0269e19e9c3dce2f5360a03d30194c43dd26f6bf43d773e9500d53ac14b022100bcfa41a6ed2015b08fbb6e732a1fff7b02870b00738c695664e8822ba263f1be:922c64590222798bb761d5b6d8e72950 |