--- policy: /ce/ca/azure/microsoft-entra-id/disable-tenant-creation logic: /ce/ca/azure/microsoft-entra-id/disable-tenant-creation/prod.logic.yaml executionTime: 2026-06-06T12:03:38.219265252Z generationMs: 51 executionMs: 1321 rows: - id: test1 match: true status: expected: INCOMPLIANT actual: INCOMPLIANT conditionIndex: expected: 199 actual: 199 conditionText: expected: CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(INCOMPLIANT) actual: CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(INCOMPLIANT) runtimeError: {} - id: test2 match: true status: expected: COMPLIANT actual: COMPLIANT conditionIndex: expected: 299 actual: 299 conditionText: expected: CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(COMPLIANT) actual: CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(COMPLIANT) runtimeError: {} - id: test3 match: true status: expected: UNDETERMINED actual: UNDETERMINED conditionIndex: expected: 400 actual: 400 conditionText: expected: otherwise actual: otherwise runtimeError: {} usedFiles: - path: /ce/ca/azure/microsoft-entra-id/disable-tenant-creation/policy.yaml md5Hash: 47CEB634472E6435113843A6376F8B61 content: | --- names: full: Microsoft Entra ID Default User Role can create tenants contextual: Default User Role can create tenants description: It is recommended to only allow an administrator to create new tenants. This prevent users from creating new Microsoft Entra ID or Azure AD B2C tenants and ensures that only authorized users are able to do so. type: COMPLIANCE_POLICY categories: - SECURITY frameworkMappings: - "/frameworks/cis-azure-v5.0.0/05/04" - "/frameworks/cloudaware/identity-and-access-governance/general-access-controls" - path: /ce/ca/azure/microsoft-entra-id/disable-tenant-creation/prod.logic.yaml md5Hash: 5BF656657D34E5B5D64F278C5B7AD307 content: | --- inputType: "CA10__CaAzureActiveDirectory__c" testData: - file: "test-data.json" conditions: - status: "INCOMPLIANT" currentStateMessage: "The default user role can create tenants." remediationMessage: "Prevent the default user role from creating tenants." check: RELATED_LIST_HAS: status: "INCOMPLIANT" relationshipName: "CA10Z1__Azure_Active_Directory_Auth_Policies__r" - status: "COMPLIANT" currentStateMessage: "The default user role cannot create tenants." check: RELATED_LIST_HAS: status: "COMPLIANT" relationshipName: "CA10Z1__Azure_Active_Directory_Auth_Policies__r" - status: "UNDETERMINED" currentStateMessage: "Unable to determine the default user role permissions." check: RELATED_LIST_HAS: status: "UNDETERMINED" relationshipName: "CA10Z1__Azure_Active_Directory_Auth_Policies__r" otherwise: status: "UNDETERMINED" currentStateMessage: "The Authorization Policy for Microsoft Entra is not present in the CMDB." relatedLists: - relationshipName: "CA10Z1__Azure_Active_Directory_Auth_Policies__r" importExtracts: - file: "/types/CA10Z1__CaAzureActiveDirectoryAuthPolicy__c/object.extracts.yaml" conditions: - status: "INCOMPLIANT" currentStateMessage: "The default user role can create tenants." remediationMessage: "Prevent the default user role from creating tenants." check: IS_EQUAL: left: EXTRACT: "CA10Z1__defaultPermissionCreateTenants__c" right: TEXT: "Enabled" - status: "COMPLIANT" currentStateMessage: "The default user role cannot create tenants." check: IS_EQUAL: left: EXTRACT: "CA10Z1__defaultPermissionCreateTenants__c" right: TEXT: "Disabled" otherwise: status: "UNDETERMINED" currentStateMessage: "Unexpected value in the field." - path: /ce/ca/azure/microsoft-entra-id/disable-tenant-creation/test-data.json md5Hash: 95F0A6AE43FA583AA56EED01AC066675 content: |- [ { "expectedResult": { "status": "INCOMPLIANT", "conditionIndex": "199", "conditionText": "CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(INCOMPLIANT)", "runtimeError": null }, "context": { "snapshotTime": "2024-11-11T19:24:25Z" }, "Id": "test1", "CA10Z1__Azure_Active_Directory_Auth_Policies__r": [ { "Id": "test1_1", "CA10Z1__disappearanceTime__c": null, "CA10Z1__defaultPermissionCreateTenants__c": "Enabled", "CA10Z1__activeDirectory__c": "test1" } ] }, { "expectedResult": { "status": "COMPLIANT", "conditionIndex": "299", "conditionText": "CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(COMPLIANT)", "runtimeError": null }, "context": { "snapshotTime": "2024-11-11T19:24:25Z" }, "Id": "test2", "CA10Z1__Azure_Active_Directory_Auth_Policies__r": [ { "Id": "test2_1", "CA10Z1__disappearanceTime__c": null, "CA10Z1__defaultPermissionCreateTenants__c": "Disabled", "CA10Z1__activeDirectory__c": "test2" } ] }, { "expectedResult": { "status": "UNDETERMINED", "conditionIndex": "400", "conditionText": "otherwise", "runtimeError": null }, "context": { "snapshotTime": "2024-11-11T19:24:25Z" }, "Id": "test3", "CA10Z1__Azure_Active_Directory_Auth_Policies__r": [] } ] - path: /types/CA10Z1__CaAzureActiveDirectoryAuthPolicy__c/object.extracts.yaml md5Hash: 0D0D0A881B5C2BBE41D5A8A7C629F5FD content: "---\nextracts:\n# Values: none, adminsAndGuestInviters, adminsGuestInvitersAndAllMembers,\ \ everyone. Not Nullable. Can't have no access, retrieved via policies/authorizationPolicy\n\ \ - name: \"CA10Z1__invitesFromState__c\"\n value: \n FIELD:\n \ \ path: \"CA10Z1__invitesFromState__c\"\n undeterminedIf:\n \ \ isEmpty: \"Corrupted data. The Allow Invites authorization setting cannot\ \ be empty.\"\n# Values: \n# User (a0b1b346-4d3e-4e8b-98f8-753987be4970)\n#\ \ Guest User (10dae51f-b6af-4016-8d66-8c2a99b929b3)\n# Restricted Guest User\ \ (2af84b1e-32c8-42b7-82bc-daa82404023b).\n# Can't have no access, retrieved\ \ via policies/authorizationPolicy\n - name: \"CA10Z1__guestUserRoleId__c\"\ \n value: \n FIELD:\n path: \"CA10Z1__guestUserRoleId__c\"\n\ \ undeterminedIf:\n isEmpty: \"Corrupted data. The Guest User\ \ Role Id cannot be empty.\"\n# Values: Enabled, Disabled. Not Nullable. Can't\ \ have no access, retrieved via policies/authorizationPolicy\n - name: \"CA10Z1__defaultPermissionCreateTenants__c\"\ \n value: \n FIELD:\n path: \"CA10Z1__defaultPermissionCreateTenants__c\"\ \n undeterminedIf:\n isEmpty: \"Corrupted data. The Allowed\ \ To Create Tenants default setting cannot be empty.\"\n# Values: Enabled, Disabled.\ \ Not Nullable. Can't have no access, retrieved via policies/authorizationPolicy\n\ \ - name: \"CA10Z1__defaultPermissionCreateApps__c\"\n value: \n FIELD:\n\ \ path: \"CA10Z1__defaultPermissionCreateApps__c\"\n undeterminedIf:\n\ \ isEmpty: \"Corrupted data. The Allowed To Create Apps default setting\ \ cannot be empty.\"\n\n" script: |- CREATE TEMP FUNCTION mock_ExpectedResult() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "Id" : "test1", "expectedResult" : { "status" : "INCOMPLIANT", "conditionIndex" : "199", "conditionText" : "CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(INCOMPLIANT)", "runtimeError" : null } }, { "Id" : "test2", "expectedResult" : { "status" : "COMPLIANT", "conditionIndex" : "299", "conditionText" : "CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(COMPLIANT)", "runtimeError" : null } }, { "Id" : "test3", "expectedResult" : { "status" : "UNDETERMINED", "conditionIndex" : "400", "conditionText" : "otherwise", "runtimeError" : null } } ]; """; CREATE TEMP FUNCTION mock_CA10Z1__CaAzureActiveDirectoryAuthPolicy__c() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "context" : { "snapshotTime" : new Date("2024-11-11T19:24:25Z") }, "CA10Z1__defaultPermissionCreateTenants__c" : "Enabled", "CA10Z1__activeDirectory__c" : "test1", "Id" : "test1_1" }, { "context" : { "snapshotTime" : new Date("2024-11-11T19:24:25Z") }, "CA10Z1__defaultPermissionCreateTenants__c" : "Disabled", "CA10Z1__activeDirectory__c" : "test2", "Id" : "test2_1" } ]; """; CREATE TEMP FUNCTION mock_CA10__CaAzureActiveDirectory__c() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "context" : { "snapshotTime" : new Date("2024-11-11T19:24:25Z") }, "Id" : "test1" }, { "context" : { "snapshotTime" : new Date("2024-11-11T19:24:25Z") }, "Id" : "test2" }, { "context" : { "snapshotTime" : new Date("2024-11-11T19:24:25Z") }, "Id" : "test3" } ]; """; CREATE TEMP FUNCTION process_CA10__CaAzureActiveDirectory__c( obj STRUCT< CA10Z1__Azure_Active_Directory_Auth_Policies__r ARRAY >>, Id STRING >, snapshotTime TIMESTAMP ) RETURNS STRUCT DETERMINISTIC LANGUAGE js AS r""" var references1 = []; // condition[0], conditionIndex:[0..99] if (false) { return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared()", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } var count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_INCOMPLIANT2 = 0; if (obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r != null) { for (var i3 = 0; i3 < obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r.length; i3++) { if (typeof(obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i3].status) !== 'undefined') { if (obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i3].status == 'INCOMPLIANT') { count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_INCOMPLIANT2 += obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i3].count; } } else { if (obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i3].result.status == 'INCOMPLIANT') { count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_INCOMPLIANT2 += 1; } } } } // condition[1], conditionIndex:[100..199] references1.push('Related list [CA10Z1__Azure_Active_Directory_Auth_Policies__r] ' + (count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_INCOMPLIANT2 > 0 ? 'has' : 'does not have') + ' objects in INCOMPLIANT status'); if (count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_INCOMPLIANT2 > 0) { return {status: 'INCOMPLIANT', conditionIndex: 199, conditionText: "CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(INCOMPLIANT)", currentStateMessage: "The default user role can create tenants.", currentStateReferences: references1.join('\n'), remediation: "Prevent the default user role from creating tenants.", runtimeError: null}; } var count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_COMPLIANT4 = 0; if (obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r != null) { for (var i5 = 0; i5 < obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r.length; i5++) { if (typeof(obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i5].status) !== 'undefined') { if (obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i5].status == 'COMPLIANT') { count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_COMPLIANT4 += obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i5].count; } } else { if (obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i5].result.status == 'COMPLIANT') { count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_COMPLIANT4 += 1; } } } } // condition[2], conditionIndex:[200..299] if (count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_COMPLIANT4 > 0) { return {status: 'COMPLIANT', conditionIndex: 299, conditionText: "CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(COMPLIANT)", currentStateMessage: "The default user role cannot create tenants.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } var count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_UNDETERMINED6 = 0; if (obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r != null) { for (var i7 = 0; i7 < obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r.length; i7++) { if (typeof(obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i7].status) !== 'undefined') { if (obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i7].status == 'UNDETERMINED') { count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_UNDETERMINED6 += obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i7].count; } } else { if (obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i7].result.status == 'UNDETERMINED') { count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_UNDETERMINED6 += 1; } } } } // condition[3], conditionIndex:[300..399] if (count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_UNDETERMINED6 > 0) { return {status: 'UNDETERMINED', conditionIndex: 399, conditionText: "CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(UNDETERMINED)", currentStateMessage: "Unable to determine the default user role permissions.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } return {status: 'UNDETERMINED', conditionIndex: 400, conditionText: "otherwise", currentStateMessage: "The Authorization Policy for Microsoft Entra is not present in the CMDB.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; """; CREATE TEMP FUNCTION process_CA10Z1__Azure_Active_Directory_Auth_Policies__r( obj STRUCT< CA10Z1__disappearanceTime__c TIMESTAMP, CA10Z1__defaultPermissionCreateTenants__c STRING, CA10Z1__activeDirectory__c STRING, Id STRING >, snapshotTime TIMESTAMP ) RETURNS STRUCT DETERMINISTIC LANGUAGE js AS r""" var TextLib = new function () { this.normalize = function(arg) { return arg == null ? '' : arg.replace(/\s+/g, ' ').trim().toLowerCase(); }; this.isEmpty = function(arg) { return this.normalize(arg) == ''; }; this.isNotEmpty = function(arg) { return this.normalize(arg) != ''; }; this.equal = function(left, right) { return this.normalize(left) == this.normalize(right); }; this.notEqual = function(left, right) { return this.normalize(left) != this.normalize(right); }; this.startsWith = function(arg, substring) { return this.normalize(arg).startsWith(this.normalize(substring)); }; this.endsWith = function(arg, substring) { return this.normalize(arg).endsWith(this.normalize(substring)); }; this.contains = function(arg, substring) { return this.normalize(arg).includes(this.normalize(substring)); }; this.containsAll = function(arg, substrings) { if (substrings == null || substrings.length === 0) return false; let normalizedArg = this.normalize(arg); return substrings.every(sub => normalizedArg.includes(this.normalize(sub))); }; this.containsAny = function(arg, substrings) { if (substrings == null || substrings.length === 0) return false; let normalizedArg = this.normalize(arg); return substrings.some(sub => normalizedArg.includes(this.normalize(sub))); }; }(); var references1 = []; // condition[0], conditionIndex:[0..99] references1.push('Deleted From Azure [CA10Z1__disappearanceTime__c]: ' + obj.CA10Z1__disappearanceTime__c); if (obj.CA10Z1__disappearanceTime__c != null) { return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10Z1__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[1], conditionIndex:[100..199] function fieldChecked4() { if (TextLib.isEmpty(obj.CA10Z1__defaultPermissionCreateTenants__c)) { throw new Error("UNDETERMINED condition:101", {cause: {status: 'UNDETERMINED', conditionIndex: 101, conditionText: "CA10Z1__defaultPermissionCreateTenants__c.isEmpty()", currentStateMessage: "Corrupted data. The Allowed To Create Tenants default setting cannot be empty.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}}); } return obj.CA10Z1__defaultPermissionCreateTenants__c; } function extract3() { if (!this.out) { this.out = fieldChecked4(); } return this.out; }; references1.push('Default Permission: Create Tenants [obj.CA10Z1__defaultPermissionCreateTenants__c]: ' + obj.CA10Z1__defaultPermissionCreateTenants__c); try { if (TextLib.equal(extract3.call(extract3), 'Enabled')) { return {status: 'INCOMPLIANT', conditionIndex: 199, conditionText: "extract('CA10Z1__defaultPermissionCreateTenants__c') == 'Enabled'", currentStateMessage: "The default user role can create tenants.", currentStateReferences: references1.join('\n'), remediation: "Prevent the default user role from creating tenants.", runtimeError: null}; } } catch (err) { if (err.cause && err.cause.status) { return err.cause; } else { throw err; } } // condition[2], conditionIndex:[200..299] function fieldChecked7() { if (TextLib.isEmpty(obj.CA10Z1__defaultPermissionCreateTenants__c)) { throw new Error("UNDETERMINED condition:201", {cause: {status: 'UNDETERMINED', conditionIndex: 201, conditionText: "CA10Z1__defaultPermissionCreateTenants__c.isEmpty()", currentStateMessage: "Corrupted data. The Allowed To Create Tenants default setting cannot be empty.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}}); } return obj.CA10Z1__defaultPermissionCreateTenants__c; } function extract6() { if (!this.out) { this.out = fieldChecked7(); } return this.out; }; try { if (TextLib.equal(extract6.call(extract6), 'Disabled')) { return {status: 'COMPLIANT', conditionIndex: 299, conditionText: "extract('CA10Z1__defaultPermissionCreateTenants__c') == 'Disabled'", currentStateMessage: "The default user role cannot create tenants.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } } catch (err) { if (err.cause && err.cause.status) { return err.cause; } else { throw err; } } return {status: 'UNDETERMINED', conditionIndex: 300, conditionText: "otherwise", currentStateMessage: "Unexpected value in the field.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; """; SELECT expectedResult.Id as Id, IF ( IFNULL(expectedResult.expectedResult.status, '') = IFNULL(sObject.result.status, '') AND IFNULL(expectedResult.expectedResult.conditionIndex, -1) = IFNULL(sObject.result.conditionIndex, -1) AND IFNULL(expectedResult.expectedResult.conditionText, '') = IFNULL(sObject.result.conditionText, '') AND IFNULL(expectedResult.expectedResult.runtimeError, '') = IFNULL(sObject.result.runtimeError, ''), "MATCH", "FAIL" ) as match, expectedResult.expectedResult.status as expectedStatus, sObject.result.status as actualStatus, expectedResult.expectedResult.conditionIndex as expectedConditionIndex, sObject.result.conditionIndex as actualConditionIndex, expectedResult.expectedResult.conditionText as expectedConditionText, sObject.result.conditionText as actualConditionText, expectedResult.expectedResult.runtimeError as expectedRuntimeError, sObject.result.runtimeError as actualRuntimeError FROM UNNEST(mock_ExpectedResult()) expectedResult LEFT JOIN ( SELECT `CA10Z1__Azure_Active_Directory_Auth_Policies__r`.arr AS CA10Z1__Azure_Active_Directory_Auth_Policies__r, sObject.Id AS Id, process_CA10__CaAzureActiveDirectory__c( STRUCT( `CA10Z1__Azure_Active_Directory_Auth_Policies__r`.arr AS CA10Z1__Azure_Active_Directory_Auth_Policies__r, sObject.Id AS Id ), sObject.context.snapshotTime ) as result FROM UNNEST(mock_CA10__CaAzureActiveDirectory__c()) AS sObject LEFT JOIN ( SELECT sObject.CA10Z1__activeDirectory__c, ARRAY_AGG( STRUCT( sObject.CA10Z1__disappearanceTime__c AS CA10Z1__disappearanceTime__c, sObject.CA10Z1__defaultPermissionCreateTenants__c AS CA10Z1__defaultPermissionCreateTenants__c, sObject.CA10Z1__activeDirectory__c AS CA10Z1__activeDirectory__c, sObject.Id AS Id, process_CA10Z1__Azure_Active_Directory_Auth_Policies__r( STRUCT( sObject.CA10Z1__disappearanceTime__c AS CA10Z1__disappearanceTime__c, sObject.CA10Z1__defaultPermissionCreateTenants__c AS CA10Z1__defaultPermissionCreateTenants__c, sObject.CA10Z1__activeDirectory__c AS CA10Z1__activeDirectory__c, sObject.Id AS Id ), sObject.context.snapshotTime ) as result ) ) AS arr FROM UNNEST(mock_CA10Z1__CaAzureActiveDirectoryAuthPolicy__c()) AS sObject GROUP BY sObject.CA10Z1__activeDirectory__c ) AS `CA10Z1__Azure_Active_Directory_Auth_Policies__r` ON sObject.Id = `CA10Z1__Azure_Active_Directory_Auth_Policies__r`.CA10Z1__activeDirectory__c ) sObject ON sObject.Id = expectedResult.Id;