💼 1 Identity and Access Management
- Contextual name: 💼 1 Identity and Access Management
- ID:
/frameworks/cis-azure-v1.3.0/01
- Located in: 💼 CIS Azure v1.3.0
Description
This section covers security recommendations that to follow to set identity and access management policies on an Azure Subscription. Identity and Access Management policies are the first step towards a defense-in-depth approach to securing an Azure Cloud Platform environment.
Most of the recommendations from this section are marked as "Not Scored" because of the lack of "Azure native CLI and API support" to perform the respective audits. However, from a security posture standpoint, these recommendations are important. According to the last communication with the Microsoft Support team regarding "Azure native CLI and API support", Microsoft teams are working to enhance "Microsoft graph API" to support all these "Azure AD" functionalities. Once we get this capability through "Microsoft Graph API", we will update the involved recommendations with the respective audit and remediation steps to make them as scored.
Similar
Sub Sections
| Section | Sub Sections | Internal Rules | Policies | Flags |
|---|
| 💼 1.1 Ensure that multi-factor authentication is enabled for all privileged users - Level 1 (Manual _ Not supported, no API/CLI available by Azure) | | | | |
| 💼 1.2 Ensure that multi-factor authentication is enabled for all non-privileged users - Level 2 (Manual _ Not supported, no API/CLI available by Azure) | | | | |
| 💼 1.3 Ensure guest users are reviewed on a monthly basis - Level 1 (Manual _ Assessment requires a manual procedure. Hover over the title for the full description) | | | | |
| 💼 1.4 Ensure that 'Allow users to remember multi-factor authentication on devices they trust' is 'Disabled' - Level 2 (Manual _ Not supported, no API/CLI available by Azure) | | | | |
| 💼 1.5 Ensure that 'Number of methods required to reset' is set to '2' - Level 1 (Manual _ Not supported, no API/CLI available by Azure) | | | | |
| 💼 1.6 Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to "0" - Level 1 (Manual _ Not supported, no API/CLI available by Azure) | | | | |
| 💼 1.7 Ensure that 'Notify users on password resets?' is set to 'Yes' - Level 1 (Manual _ Not supported, no API/CLI available by Azure) | | | | |
| 💼 1.8 Ensure that 'Notify all admins when other admins reset their password?' is set to 'Yes' - Level 2 (Manual _ Not supported, no API/CLI available by Azure) | | | | |
| 💼 1.9 Ensure that 'Users can consent to apps accessing company data on their behalf' is set to 'No' - Level 2 (Manual _ Not supported, no API/CLI available by Azure) | | | | |
| 💼 1.10 Ensure that 'Users can add gallery apps to their Access Panel' is set to 'No' - Level 2 (Manual _ Not supported, no API/CLI available by Azure) | | | | |
| 💼 1.11 Ensure that 'Users can register applications' is set to 'No' - Level 2 (Manual _ Not supported, no API/CLI available by Azure) | | | | |
| 💼 1.12 Ensure that 'Guest user permissions are limited' is set to 'Yes' - Level 2 (Manual _ Not supported, no API/CLI available by Azure) | | | | |
| 💼 1.13 Ensure that 'Members can invite' is set to 'No' - Level 2 (Manual _ Not supported, no API/CLI available by Azure) | | | | |
| 💼 1.14 Ensure that 'Guests can invite' is set to 'No' - Level 2 (Manual _ Not supported, no API/CLI available by Azure) | | | | |
| 💼 1.15 Ensure that 'Restrict access to Azure AD administration portal' is set to 'Yes' - Level 1 (Manual _ Not supported, no API/CLI available by Azure) | | | | |
| 💼 1.16 Ensure that 'Restrict user ability to access groups features in the Access Pane' is set to 'No' - Level 2 (Manual _ Not supported, no API/CLI available by Azure) | | | | |
| 💼 1.17 Ensure that 'Users can create security groups in Azure Portals' is set to 'No' - Level 2 (Manual _ Not supported, no API/CLI available by Azure) | | | | |
| 💼 1.18 Ensure that 'Owners can manage group membership requests in the Access Panel' is set to 'No' - Level 2 (Manual _ Not supported, no API/CLI available by Azure) | | | | |
| 💼 1.19 Ensure that 'Users can create Microsoft 365 groups in Azure Portals' is set to 'No' - Level 2 (Manual _ Not supported, no API/CLI available by Azure) | | | | |
| 💼 1.20 Ensure that 'Require Multi-Factor Auth to join devices' is set to 'Yes' - Level 1 (Manual _ Not supported, no API/CLI available by Azure) | | | | |
| 💼 1.21 Ensure that no custom subscription owner roles are created - Level 2 (Automated) | | | | |
| 💼 1.22 Ensure Security Defaults is enabled on Azure Active Directory - Level 1 (Automated _ Not supported, no API/CLI available by Azure) | | | | |
| 💼 1.23 Ensure Custom Role is assigned for Administering Resource Locks - Level 2 (Manual) | | | | |