@sagentix-inc/evidence-collector 0.3.0 → 0.3.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/THIRD_PARTY_NOTICES.md +14 -14
- package/apps/sos-app/src/data/checks/aws.json +2 -2
- package/apps/sos-app/src/data/checks/checkov.json +59 -59
- package/apps/sos-app/src/data/checks/kubescape.json +1 -1
- package/apps/sos-app/src/data/checks/prowler_aws.json +1926 -491
- package/apps/sos-app/src/data/checks/prowler_azure.json +634 -137
- package/apps/sos-app/src/data/checks/prowler_cloudflare.json +207 -3
- package/apps/sos-app/src/data/checks/prowler_gcp.json +274 -92
- package/apps/sos-app/src/data/checks/prowler_github.json +193 -3
- package/apps/sos-app/src/data/checks/prowler_googleworkspace.json +459 -3
- package/apps/sos-app/src/data/checks/prowler_kubernetes.json +208 -75
- package/apps/sos-app/src/data/checks/prowler_m365.json +643 -69
- package/apps/sos-app/src/data/checks/prowler_okta.json +207 -3
- package/apps/sos-app/src/data/fedramp_rules.json +1 -1
- package/collector/package.json +1 -1
- package/collector/src/sources/aws/checks.js +4 -1
- package/collector/src/sources/prowler.js +81 -26
- package/package.json +1 -1
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"source": "prowler",
|
|
3
|
-
"title": "Prowler 5.
|
|
3
|
+
"title": "Prowler 5.47.0: Microsoft 365 (runs in the customer's CI with read-only credentials)",
|
|
4
4
|
"readScopes": [
|
|
5
5
|
"Microsoft Graph application: AccessReview.Read.All",
|
|
6
6
|
"AuditLog.Read.All",
|
|
@@ -19,478 +19,1052 @@
|
|
|
19
19
|
],
|
|
20
20
|
"engine": {
|
|
21
21
|
"name": "Prowler",
|
|
22
|
-
"version": "5.
|
|
22
|
+
"version": "5.47.0",
|
|
23
23
|
"licence": "Apache-2.0",
|
|
24
24
|
"url": "https://github.com/prowler-cloud/prowler"
|
|
25
25
|
},
|
|
26
26
|
"provider": "m365",
|
|
27
27
|
"checks": [
|
|
28
|
+
{
|
|
29
|
+
"id": "prowler.m365.admincenter_external_calendar_sharing_disabled",
|
|
30
|
+
"title": "External calendar sharing is disabled at the organization level",
|
|
31
|
+
"scope": "Prowler 5.47.0 check admincenter_external_calendar_sharing_disabled (Microsoft 365 admincenter, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
32
|
+
"evidenceType": "Configuration",
|
|
33
|
+
"severity": "medium"
|
|
34
|
+
},
|
|
35
|
+
{
|
|
36
|
+
"id": "prowler.m365.admincenter_groups_not_public_visibility",
|
|
37
|
+
"title": "Microsoft 365 group has Private visibility",
|
|
38
|
+
"scope": "Prowler 5.47.0 check admincenter_groups_not_public_visibility (Microsoft 365 admincenter, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
39
|
+
"evidenceType": "Configuration",
|
|
40
|
+
"severity": "high"
|
|
41
|
+
},
|
|
42
|
+
{
|
|
43
|
+
"id": "prowler.m365.admincenter_organization_customer_lockbox_enabled",
|
|
44
|
+
"title": "Customer Lockbox is enabled at the organization level",
|
|
45
|
+
"scope": "Prowler 5.47.0 check admincenter_organization_customer_lockbox_enabled (Microsoft 365 admincenter, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
46
|
+
"evidenceType": "Configuration",
|
|
47
|
+
"severity": "high"
|
|
48
|
+
},
|
|
49
|
+
{
|
|
50
|
+
"id": "prowler.m365.admincenter_settings_password_never_expire",
|
|
51
|
+
"title": "Tenant password policy is set to never expire",
|
|
52
|
+
"scope": "Prowler 5.47.0 check admincenter_settings_password_never_expire (Microsoft 365 admincenter, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
53
|
+
"evidenceType": "Configuration",
|
|
54
|
+
"severity": "medium"
|
|
55
|
+
},
|
|
56
|
+
{
|
|
57
|
+
"id": "prowler.m365.admincenter_shared_bookings_disabled",
|
|
58
|
+
"title": "Microsoft Shared Bookings is disabled",
|
|
59
|
+
"scope": "Prowler 5.47.0 check admincenter_shared_bookings_disabled (Microsoft 365 admincenter, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
60
|
+
"evidenceType": "Configuration",
|
|
61
|
+
"severity": "medium"
|
|
62
|
+
},
|
|
28
63
|
{
|
|
29
64
|
"id": "prowler.m365.admincenter_users_admins_reduced_license_footprint",
|
|
30
65
|
"title": "Administrative user has no license or an allowed license (AAD_PREMIUM or AAD_PREMIUM_P2)",
|
|
31
|
-
"scope": "Prowler 5.
|
|
66
|
+
"scope": "Prowler 5.47.0 check admincenter_users_admins_reduced_license_footprint (Microsoft 365 admincenter, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
32
67
|
"evidenceType": "Configuration",
|
|
33
68
|
"severity": "high"
|
|
34
69
|
},
|
|
35
70
|
{
|
|
36
71
|
"id": "prowler.m365.admincenter_users_between_two_and_four_global_admins",
|
|
37
72
|
"title": "Tenant has between two and four Global Administrators",
|
|
38
|
-
"scope": "Prowler 5.
|
|
73
|
+
"scope": "Prowler 5.47.0 check admincenter_users_between_two_and_four_global_admins (Microsoft 365 admincenter, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
74
|
+
"evidenceType": "Configuration",
|
|
75
|
+
"severity": "medium"
|
|
76
|
+
},
|
|
77
|
+
{
|
|
78
|
+
"id": "prowler.m365.defender_antiphishing_policy_configured",
|
|
79
|
+
"title": "Defender anti-phishing policy active, quarantines spoofed senders and DMARC reject/quarantine failures, honors DMARC policy, safety tips enabled",
|
|
80
|
+
"scope": "Prowler 5.47.0 check defender_antiphishing_policy_configured (Microsoft 365 defender, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
81
|
+
"evidenceType": "Configuration",
|
|
82
|
+
"severity": "low"
|
|
83
|
+
},
|
|
84
|
+
{
|
|
85
|
+
"id": "prowler.m365.defender_antispam_connection_filter_policy_empty_ip_allowlist",
|
|
86
|
+
"title": "Defender Antispam Connection Filter Policy IP Allowlist is empty or undefined",
|
|
87
|
+
"scope": "Prowler 5.47.0 check defender_antispam_connection_filter_policy_empty_ip_allowlist (Microsoft 365 defender, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
88
|
+
"evidenceType": "Configuration",
|
|
89
|
+
"severity": "medium"
|
|
90
|
+
},
|
|
91
|
+
{
|
|
92
|
+
"id": "prowler.m365.defender_antispam_connection_filter_policy_safe_list_off",
|
|
93
|
+
"title": "Defender Antispam Connection Filter Policy has Safe List disabled",
|
|
94
|
+
"scope": "Prowler 5.47.0 check defender_antispam_connection_filter_policy_safe_list_off (Microsoft 365 defender, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
95
|
+
"evidenceType": "Configuration",
|
|
96
|
+
"severity": "medium"
|
|
97
|
+
},
|
|
98
|
+
{
|
|
99
|
+
"id": "prowler.m365.defender_antispam_outbound_policy_configured",
|
|
100
|
+
"title": "Defender outbound spam policy is configured to notify recipients when senders are blocked or exceed sending limits",
|
|
101
|
+
"scope": "Prowler 5.47.0 check defender_antispam_outbound_policy_configured (Microsoft 365 defender, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
102
|
+
"evidenceType": "Configuration",
|
|
103
|
+
"severity": "low"
|
|
104
|
+
},
|
|
105
|
+
{
|
|
106
|
+
"id": "prowler.m365.defender_antispam_outbound_policy_forwarding_disabled",
|
|
107
|
+
"title": "Defender Outbound Spam policy disables mail forwarding",
|
|
108
|
+
"scope": "Prowler 5.47.0 check defender_antispam_outbound_policy_forwarding_disabled (Microsoft 365 defender, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
109
|
+
"evidenceType": "Configuration",
|
|
110
|
+
"severity": "high"
|
|
111
|
+
},
|
|
112
|
+
{
|
|
113
|
+
"id": "prowler.m365.defender_antispam_policy_inbound_no_allowed_domains",
|
|
114
|
+
"title": "Inbound anti-spam policy does not contain allowed domains",
|
|
115
|
+
"scope": "Prowler 5.47.0 check defender_antispam_policy_inbound_no_allowed_domains (Microsoft 365 defender, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
116
|
+
"evidenceType": "Configuration",
|
|
117
|
+
"severity": "low"
|
|
118
|
+
},
|
|
119
|
+
{
|
|
120
|
+
"id": "prowler.m365.defender_atp_safe_attachments_and_docs_configured",
|
|
121
|
+
"title": "ATP Safe Attachments policy has Safe Documents enabled and click-through blocked for SharePoint, OneDrive, and Microsoft Teams",
|
|
122
|
+
"scope": "Prowler 5.47.0 check defender_atp_safe_attachments_and_docs_configured (Microsoft 365 defender, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
123
|
+
"evidenceType": "Configuration",
|
|
124
|
+
"severity": "medium"
|
|
125
|
+
},
|
|
126
|
+
{
|
|
127
|
+
"id": "prowler.m365.defender_chat_report_policy_configured",
|
|
128
|
+
"title": "Defender report submission policy uses customized addresses for junk, not junk and phish, and chat reports are sent only to a customized address",
|
|
129
|
+
"scope": "Prowler 5.47.0 check defender_chat_report_policy_configured (Microsoft 365 defender, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
39
130
|
"evidenceType": "Configuration",
|
|
40
131
|
"severity": "medium"
|
|
41
132
|
},
|
|
42
133
|
{
|
|
43
134
|
"id": "prowler.m365.defender_domain_dkim_enabled",
|
|
44
135
|
"title": "Exchange Online domain has DKIM enabled",
|
|
45
|
-
"scope": "Prowler 5.
|
|
136
|
+
"scope": "Prowler 5.47.0 check defender_domain_dkim_enabled (Microsoft 365 defender, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
46
137
|
"evidenceType": "Configuration",
|
|
47
138
|
"severity": "high"
|
|
48
139
|
},
|
|
49
140
|
{
|
|
50
141
|
"id": "prowler.m365.defender_domain_dmarc_records_published",
|
|
51
142
|
"title": "Exchange Online domain has a DMARC record published with an enforcement policy",
|
|
52
|
-
"scope": "Prowler 5.
|
|
143
|
+
"scope": "Prowler 5.47.0 check defender_domain_dmarc_records_published (Microsoft 365 defender, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
144
|
+
"evidenceType": "Configuration",
|
|
145
|
+
"severity": "medium"
|
|
146
|
+
},
|
|
147
|
+
{
|
|
148
|
+
"id": "prowler.m365.defender_malware_policy_common_attachments_filter_enabled",
|
|
149
|
+
"title": "Defender malware policy has Common Attachment Types Filter enabled",
|
|
150
|
+
"scope": "Prowler 5.47.0 check defender_malware_policy_common_attachments_filter_enabled (Microsoft 365 defender, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
151
|
+
"evidenceType": "Configuration",
|
|
152
|
+
"severity": "critical"
|
|
153
|
+
},
|
|
154
|
+
{
|
|
155
|
+
"id": "prowler.m365.defender_malware_policy_comprehensive_attachments_filter_applied",
|
|
156
|
+
"title": "Defender anti-malware policy has Common Attachment Types Filter enabled and blocks all recommended file types",
|
|
157
|
+
"scope": "Prowler 5.47.0 check defender_malware_policy_comprehensive_attachments_filter_applied (Microsoft 365 defender, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
158
|
+
"evidenceType": "Configuration",
|
|
159
|
+
"severity": "high"
|
|
160
|
+
},
|
|
161
|
+
{
|
|
162
|
+
"id": "prowler.m365.defender_malware_policy_notifications_internal_users_malware_enabled",
|
|
163
|
+
"title": "Defender anti-malware policy has admin notifications enabled for internal users sending malware",
|
|
164
|
+
"scope": "Prowler 5.47.0 check defender_malware_policy_notifications_internal_users_malware_enabled (Microsoft 365 defender, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
165
|
+
"evidenceType": "Configuration",
|
|
166
|
+
"severity": "medium"
|
|
167
|
+
},
|
|
168
|
+
{
|
|
169
|
+
"id": "prowler.m365.defender_priority_account_protection_enabled",
|
|
170
|
+
"title": "Priority account protection is enabled",
|
|
171
|
+
"scope": "Prowler 5.47.0 check defender_priority_account_protection_enabled (Microsoft 365 defender, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
172
|
+
"evidenceType": "Configuration",
|
|
173
|
+
"severity": "medium"
|
|
174
|
+
},
|
|
175
|
+
{
|
|
176
|
+
"id": "prowler.m365.defender_safe_attachments_policy_enabled",
|
|
177
|
+
"title": "Safe Attachments policy is enabled with secure configuration",
|
|
178
|
+
"scope": "Prowler 5.47.0 check defender_safe_attachments_policy_enabled (Microsoft 365 defender, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
179
|
+
"evidenceType": "Configuration",
|
|
180
|
+
"severity": "medium"
|
|
181
|
+
},
|
|
182
|
+
{
|
|
183
|
+
"id": "prowler.m365.defender_safelinks_policy_enabled",
|
|
184
|
+
"title": "Safe Links policy is enabled and properly configured in Microsoft Defender for Office 365.",
|
|
185
|
+
"scope": "Prowler 5.47.0 check defender_safelinks_policy_enabled (Microsoft 365 defender, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
53
186
|
"evidenceType": "Configuration",
|
|
54
187
|
"severity": "medium"
|
|
55
188
|
},
|
|
56
189
|
{
|
|
57
190
|
"id": "prowler.m365.defender_strict_preset_security_policy_enabled",
|
|
58
191
|
"title": "Strict Preset Security Policy is enabled",
|
|
59
|
-
"scope": "Prowler 5.
|
|
192
|
+
"scope": "Prowler 5.47.0 check defender_strict_preset_security_policy_enabled (Microsoft 365 defender, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
193
|
+
"evidenceType": "Configuration",
|
|
194
|
+
"severity": "medium"
|
|
195
|
+
},
|
|
196
|
+
{
|
|
197
|
+
"id": "prowler.m365.defender_zap_for_teams_enabled",
|
|
198
|
+
"title": "Zero-hour auto purge (ZAP) protects Microsoft Teams from malware and phishing",
|
|
199
|
+
"scope": "Prowler 5.47.0 check defender_zap_for_teams_enabled (Microsoft 365 defender, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
200
|
+
"evidenceType": "Configuration",
|
|
201
|
+
"severity": "medium"
|
|
202
|
+
},
|
|
203
|
+
{
|
|
204
|
+
"id": "prowler.m365.defenderidentity_health_issues_no_open",
|
|
205
|
+
"title": "Defender for Identity has no unresolved health issues affecting hybrid infrastructure monitoring",
|
|
206
|
+
"scope": "Prowler 5.47.0 check defenderidentity_health_issues_no_open (Microsoft 365 defenderidentity, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
207
|
+
"evidenceType": "Configuration",
|
|
208
|
+
"severity": "medium"
|
|
209
|
+
},
|
|
210
|
+
{
|
|
211
|
+
"id": "prowler.m365.defenderxdr_critical_asset_management_pending_approvals",
|
|
212
|
+
"title": "Critical asset management classifications are reviewed and approved",
|
|
213
|
+
"scope": "Prowler 5.47.0 check defenderxdr_critical_asset_management_pending_approvals (Microsoft 365 defenderxdr, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
60
214
|
"evidenceType": "Configuration",
|
|
61
215
|
"severity": "medium"
|
|
62
216
|
},
|
|
217
|
+
{
|
|
218
|
+
"id": "prowler.m365.defenderxdr_endpoint_privileged_user_exposed_credentials",
|
|
219
|
+
"title": "Privileged users do not have credentials exposed on vulnerable endpoints",
|
|
220
|
+
"scope": "Prowler 5.47.0 check defenderxdr_endpoint_privileged_user_exposed_credentials (Microsoft 365 defenderxdr, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
221
|
+
"evidenceType": "Configuration",
|
|
222
|
+
"severity": "critical"
|
|
223
|
+
},
|
|
63
224
|
{
|
|
64
225
|
"id": "prowler.m365.entra_access_review_guest_users_configured",
|
|
65
226
|
"title": "Access review for guest users is configured",
|
|
66
|
-
"scope": "Prowler 5.
|
|
227
|
+
"scope": "Prowler 5.47.0 check entra_access_review_guest_users_configured (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
67
228
|
"evidenceType": "Configuration",
|
|
68
229
|
"severity": "medium"
|
|
69
230
|
},
|
|
70
231
|
{
|
|
71
232
|
"id": "prowler.m365.entra_access_review_privileged_roles_configured",
|
|
72
233
|
"title": "Access review for privileged roles is configured",
|
|
73
|
-
"scope": "Prowler 5.
|
|
234
|
+
"scope": "Prowler 5.47.0 check entra_access_review_privileged_roles_configured (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
74
235
|
"evidenceType": "Configuration",
|
|
75
236
|
"severity": "medium"
|
|
76
237
|
},
|
|
238
|
+
{
|
|
239
|
+
"id": "prowler.m365.entra_admin_consent_workflow_enabled",
|
|
240
|
+
"title": "Admin consent workflow is enabled",
|
|
241
|
+
"scope": "Prowler 5.47.0 check entra_admin_consent_workflow_enabled (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
242
|
+
"evidenceType": "Configuration",
|
|
243
|
+
"severity": "high"
|
|
244
|
+
},
|
|
77
245
|
{
|
|
78
246
|
"id": "prowler.m365.entra_admin_portals_access_restriction",
|
|
79
247
|
"title": "Admin portals are accessible only to administrative roles",
|
|
80
|
-
"scope": "Prowler 5.
|
|
248
|
+
"scope": "Prowler 5.47.0 check entra_admin_portals_access_restriction (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
81
249
|
"evidenceType": "Configuration",
|
|
82
250
|
"severity": "medium"
|
|
83
251
|
},
|
|
84
252
|
{
|
|
85
253
|
"id": "prowler.m365.entra_admin_users_cloud_only",
|
|
86
254
|
"title": "All users with administrative roles are cloud-only accounts",
|
|
87
|
-
"scope": "Prowler 5.
|
|
255
|
+
"scope": "Prowler 5.47.0 check entra_admin_users_cloud_only (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
256
|
+
"evidenceType": "Configuration",
|
|
257
|
+
"severity": "high"
|
|
258
|
+
},
|
|
259
|
+
{
|
|
260
|
+
"id": "prowler.m365.entra_admin_users_mfa_enabled",
|
|
261
|
+
"title": "Users in administrative roles require multifactor authentication via a Conditional Access policy for all applications",
|
|
262
|
+
"scope": "Prowler 5.47.0 check entra_admin_users_mfa_enabled (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
88
263
|
"evidenceType": "Configuration",
|
|
89
264
|
"severity": "high"
|
|
90
265
|
},
|
|
91
266
|
{
|
|
92
267
|
"id": "prowler.m365.entra_admin_users_phishing_resistant_mfa_enabled",
|
|
93
268
|
"title": "At least one Conditional Access policy requires phishing-resistant MFA strength for administrator roles",
|
|
94
|
-
"scope": "Prowler 5.
|
|
269
|
+
"scope": "Prowler 5.47.0 check entra_admin_users_phishing_resistant_mfa_enabled (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
95
270
|
"evidenceType": "Configuration",
|
|
96
271
|
"severity": "high"
|
|
97
272
|
},
|
|
98
273
|
{
|
|
99
274
|
"id": "prowler.m365.entra_admin_users_sign_in_frequency_enabled",
|
|
100
275
|
"title": "Admin users have sign-in frequency enforced by Conditional Access at or below the recommended interval",
|
|
101
|
-
"scope": "Prowler 5.
|
|
276
|
+
"scope": "Prowler 5.47.0 check entra_admin_users_sign_in_frequency_enabled (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
102
277
|
"evidenceType": "Configuration",
|
|
103
278
|
"severity": "high"
|
|
104
279
|
},
|
|
105
280
|
{
|
|
106
281
|
"id": "prowler.m365.entra_all_apps_conditional_access_coverage",
|
|
107
282
|
"title": "Conditional Access policy ensures comprehensive coverage for all cloud apps",
|
|
108
|
-
"scope": "Prowler 5.
|
|
283
|
+
"scope": "Prowler 5.47.0 check entra_all_apps_conditional_access_coverage (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
109
284
|
"evidenceType": "Configuration",
|
|
110
285
|
"severity": "medium"
|
|
111
286
|
},
|
|
112
287
|
{
|
|
113
288
|
"id": "prowler.m365.entra_app_registration_client_secret_unused",
|
|
114
289
|
"title": "Application registrations should not use client secrets",
|
|
115
|
-
"scope": "Prowler 5.
|
|
290
|
+
"scope": "Prowler 5.47.0 check entra_app_registration_client_secret_unused (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
291
|
+
"evidenceType": "Configuration",
|
|
292
|
+
"severity": "medium"
|
|
293
|
+
},
|
|
294
|
+
{
|
|
295
|
+
"id": "prowler.m365.entra_app_registration_no_unused_privileged_permissions",
|
|
296
|
+
"title": "App registration has no unused privileged API permissions",
|
|
297
|
+
"scope": "Prowler 5.47.0 check entra_app_registration_no_unused_privileged_permissions (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
298
|
+
"evidenceType": "Configuration",
|
|
299
|
+
"severity": "medium"
|
|
300
|
+
},
|
|
301
|
+
{
|
|
302
|
+
"id": "prowler.m365.entra_app_registration_redirect_uris_secure",
|
|
303
|
+
"title": "Secure redirect URIs protect application registration tokens from interception and theft",
|
|
304
|
+
"scope": "Prowler 5.47.0 check entra_app_registration_redirect_uris_secure (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
305
|
+
"evidenceType": "Configuration",
|
|
306
|
+
"severity": "medium"
|
|
307
|
+
},
|
|
308
|
+
{
|
|
309
|
+
"id": "prowler.m365.entra_authentication_method_authenticator_show_context",
|
|
310
|
+
"title": "Microsoft Authenticator shows application name and geographic location",
|
|
311
|
+
"scope": "Prowler 5.47.0 check entra_authentication_method_authenticator_show_context (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
312
|
+
"evidenceType": "Configuration",
|
|
313
|
+
"severity": "medium"
|
|
314
|
+
},
|
|
315
|
+
{
|
|
316
|
+
"id": "prowler.m365.entra_authentication_method_email_otp_disabled",
|
|
317
|
+
"title": "Email One-Time Passcode authentication method is disabled in the tenant",
|
|
318
|
+
"scope": "Prowler 5.47.0 check entra_authentication_method_email_otp_disabled (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
319
|
+
"evidenceType": "Configuration",
|
|
320
|
+
"severity": "medium"
|
|
321
|
+
},
|
|
322
|
+
{
|
|
323
|
+
"id": "prowler.m365.entra_authentication_method_sms_voice_disabled",
|
|
324
|
+
"title": "SMS and Voice authentication methods are disabled in the tenant",
|
|
325
|
+
"scope": "Prowler 5.47.0 check entra_authentication_method_sms_voice_disabled (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
116
326
|
"evidenceType": "Configuration",
|
|
117
327
|
"severity": "medium"
|
|
118
328
|
},
|
|
119
329
|
{
|
|
120
330
|
"id": "prowler.m365.entra_break_glass_account_fido2_security_key_registered",
|
|
121
331
|
"title": "Break glass account has a FIDO2 security key registered for phishing-resistant authentication",
|
|
122
|
-
"scope": "Prowler 5.
|
|
332
|
+
"scope": "Prowler 5.47.0 check entra_break_glass_account_fido2_security_key_registered (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
123
333
|
"evidenceType": "Configuration",
|
|
124
334
|
"severity": "critical"
|
|
125
335
|
},
|
|
336
|
+
{
|
|
337
|
+
"id": "prowler.m365.entra_conditional_access_policy_all_apps_all_users",
|
|
338
|
+
"title": "Conditional Access policy covers all cloud apps and all users",
|
|
339
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_all_apps_all_users (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
340
|
+
"evidenceType": "Configuration",
|
|
341
|
+
"severity": "low"
|
|
342
|
+
},
|
|
126
343
|
{
|
|
127
344
|
"id": "prowler.m365.entra_conditional_access_policy_app_enforced_restrictions",
|
|
128
345
|
"title": "Conditional Access policy enforces application restrictions for unmanaged devices",
|
|
129
|
-
"scope": "Prowler 5.
|
|
346
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_app_enforced_restrictions (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
130
347
|
"evidenceType": "Configuration",
|
|
131
348
|
"severity": "medium"
|
|
132
349
|
},
|
|
133
350
|
{
|
|
134
351
|
"id": "prowler.m365.entra_conditional_access_policy_approved_client_app_required_for_mobile",
|
|
135
352
|
"title": "Conditional Access policy enforces approved client apps or app protection for mobile devices",
|
|
136
|
-
"scope": "Prowler 5.
|
|
353
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_approved_client_app_required_for_mobile (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
354
|
+
"evidenceType": "Configuration",
|
|
355
|
+
"severity": "medium"
|
|
356
|
+
},
|
|
357
|
+
{
|
|
358
|
+
"id": "prowler.m365.entra_conditional_access_policy_authentication_transfer_blocked",
|
|
359
|
+
"title": "Conditional Access policy blocks authentication transfer",
|
|
360
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_authentication_transfer_blocked (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
137
361
|
"evidenceType": "Configuration",
|
|
138
362
|
"severity": "medium"
|
|
139
363
|
},
|
|
140
364
|
{
|
|
141
365
|
"id": "prowler.m365.entra_conditional_access_policy_block_elevated_insider_risk",
|
|
142
366
|
"title": "Conditional Access Policy blocks access for users with elevated insider risk",
|
|
143
|
-
"scope": "Prowler 5.
|
|
367
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_block_elevated_insider_risk (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
144
368
|
"evidenceType": "Configuration",
|
|
145
369
|
"severity": "medium"
|
|
146
370
|
},
|
|
147
371
|
{
|
|
148
372
|
"id": "prowler.m365.entra_conditional_access_policy_block_high_medium_sign_in_risk",
|
|
149
373
|
"title": "Conditional Access policy blocks high and medium sign-in risk",
|
|
150
|
-
"scope": "Prowler 5.
|
|
374
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_block_high_medium_sign_in_risk (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
151
375
|
"evidenceType": "Configuration",
|
|
152
376
|
"severity": "high"
|
|
153
377
|
},
|
|
154
378
|
{
|
|
155
379
|
"id": "prowler.m365.entra_conditional_access_policy_block_o365_elevated_insider_risk",
|
|
156
380
|
"title": "Conditional Access policy blocks Office 365 access for users with elevated insider risk",
|
|
157
|
-
"scope": "Prowler 5.
|
|
381
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_block_o365_elevated_insider_risk (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
382
|
+
"evidenceType": "Configuration",
|
|
383
|
+
"severity": "medium"
|
|
384
|
+
},
|
|
385
|
+
{
|
|
386
|
+
"id": "prowler.m365.entra_conditional_access_policy_block_unknown_device_platforms",
|
|
387
|
+
"title": "Conditional Access policy blocks access from unknown or unsupported device platforms",
|
|
388
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_block_unknown_device_platforms (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
389
|
+
"evidenceType": "Configuration",
|
|
390
|
+
"severity": "medium"
|
|
391
|
+
},
|
|
392
|
+
{
|
|
393
|
+
"id": "prowler.m365.entra_conditional_access_policy_compliant_device_hybrid_joined_device_mfa_required",
|
|
394
|
+
"title": "Conditional Access requires compliant device OR hybrid joined device OR MFA for admins or all users",
|
|
395
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_compliant_device_hybrid_joined_device_mfa_required (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
396
|
+
"evidenceType": "Configuration",
|
|
397
|
+
"severity": "high"
|
|
398
|
+
},
|
|
399
|
+
{
|
|
400
|
+
"id": "prowler.m365.entra_conditional_access_policy_corporate_device_sign_in_frequency_enforced",
|
|
401
|
+
"title": "Conditional Access policy enforces sign-in frequency for non-corporate devices",
|
|
402
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_corporate_device_sign_in_frequency_enforced (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
158
403
|
"evidenceType": "Configuration",
|
|
159
404
|
"severity": "medium"
|
|
160
405
|
},
|
|
161
406
|
{
|
|
162
407
|
"id": "prowler.m365.entra_conditional_access_policy_device_code_flow_blocked",
|
|
163
408
|
"title": "Conditional Access policy blocks device code flow to prevent phishing attacks",
|
|
164
|
-
"scope": "Prowler 5.
|
|
409
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_device_code_flow_blocked (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
410
|
+
"evidenceType": "Configuration",
|
|
411
|
+
"severity": "high"
|
|
412
|
+
},
|
|
413
|
+
{
|
|
414
|
+
"id": "prowler.m365.entra_conditional_access_policy_device_registration_mfa_required",
|
|
415
|
+
"title": "Conditional Access policies enforce MFA for device registration",
|
|
416
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_device_registration_mfa_required (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
165
417
|
"evidenceType": "Configuration",
|
|
166
418
|
"severity": "high"
|
|
167
419
|
},
|
|
420
|
+
{
|
|
421
|
+
"id": "prowler.m365.entra_conditional_access_policy_directory_sync_account_excluded",
|
|
422
|
+
"title": "Conditional Access policy excludes Directory Synchronization Accounts to protect Entra Connect sync",
|
|
423
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_directory_sync_account_excluded (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
424
|
+
"evidenceType": "Configuration",
|
|
425
|
+
"severity": "medium"
|
|
426
|
+
},
|
|
427
|
+
{
|
|
428
|
+
"id": "prowler.m365.entra_conditional_access_policy_explicitly_targets_azure_devops",
|
|
429
|
+
"title": "Conditional Access Policy explicitly targets Azure DevOps",
|
|
430
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_explicitly_targets_azure_devops (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
431
|
+
"evidenceType": "Configuration",
|
|
432
|
+
"severity": "medium"
|
|
433
|
+
},
|
|
168
434
|
{
|
|
169
435
|
"id": "prowler.m365.entra_conditional_access_policy_groups_management_restricted",
|
|
170
436
|
"title": "Conditional Access policy groups are management-restricted or role-assignable",
|
|
171
|
-
"scope": "Prowler 5.
|
|
437
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_groups_management_restricted (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
438
|
+
"evidenceType": "Configuration",
|
|
439
|
+
"severity": "high"
|
|
440
|
+
},
|
|
441
|
+
{
|
|
442
|
+
"id": "prowler.m365.entra_conditional_access_policy_mdm_compliant_device_required",
|
|
443
|
+
"title": "Conditional Access policy requires an MDM-compliant device for all cloud app access",
|
|
444
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_mdm_compliant_device_required (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
445
|
+
"evidenceType": "Configuration",
|
|
446
|
+
"severity": "high"
|
|
447
|
+
},
|
|
448
|
+
{
|
|
449
|
+
"id": "prowler.m365.entra_conditional_access_policy_mfa_enforced_for_guest_users",
|
|
450
|
+
"title": "Conditional Access Policy enforces MFA for guest and external users",
|
|
451
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_mfa_enforced_for_guest_users (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
452
|
+
"evidenceType": "Configuration",
|
|
453
|
+
"severity": "high"
|
|
454
|
+
},
|
|
455
|
+
{
|
|
456
|
+
"id": "prowler.m365.entra_conditional_access_policy_no_deleted_object_references",
|
|
457
|
+
"title": "Conditional Access policies must not reference deleted users, groups, or roles",
|
|
458
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_no_deleted_object_references (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
459
|
+
"evidenceType": "Configuration",
|
|
460
|
+
"severity": "medium"
|
|
461
|
+
},
|
|
462
|
+
{
|
|
463
|
+
"id": "prowler.m365.entra_conditional_access_policy_no_exclusion_gaps",
|
|
464
|
+
"title": "Conditional Access exclusions are covered by another policy (no exclusion gaps)",
|
|
465
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_no_exclusion_gaps (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
466
|
+
"evidenceType": "Configuration",
|
|
467
|
+
"severity": "medium"
|
|
468
|
+
},
|
|
469
|
+
{
|
|
470
|
+
"id": "prowler.m365.entra_conditional_access_policy_require_mfa_for_management_api",
|
|
471
|
+
"title": "Conditional Access Policy enforces MFA for Azure Management API access",
|
|
472
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_require_mfa_for_management_api (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
172
473
|
"evidenceType": "Configuration",
|
|
173
474
|
"severity": "high"
|
|
174
475
|
},
|
|
476
|
+
{
|
|
477
|
+
"id": "prowler.m365.entra_conditional_access_policy_sign_in_frequency_all_users",
|
|
478
|
+
"title": "Conditional Access policy enforces sign-in frequency for all users",
|
|
479
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_sign_in_frequency_all_users (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
480
|
+
"evidenceType": "Configuration",
|
|
481
|
+
"severity": "medium"
|
|
482
|
+
},
|
|
483
|
+
{
|
|
484
|
+
"id": "prowler.m365.entra_conditional_access_policy_token_protection_enforced",
|
|
485
|
+
"title": "Conditional Access policy enforces Token Protection",
|
|
486
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_token_protection_enforced (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
487
|
+
"evidenceType": "Configuration",
|
|
488
|
+
"severity": "high"
|
|
489
|
+
},
|
|
490
|
+
{
|
|
491
|
+
"id": "prowler.m365.entra_conditional_access_policy_untrusted_locations_blocked",
|
|
492
|
+
"title": "Conditional Access policy blocks access from untrusted locations",
|
|
493
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_untrusted_locations_blocked (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
494
|
+
"evidenceType": "Configuration",
|
|
495
|
+
"severity": "medium"
|
|
496
|
+
},
|
|
497
|
+
{
|
|
498
|
+
"id": "prowler.m365.entra_conditional_access_trusted_named_location_exists",
|
|
499
|
+
"title": "A trusted IP-range named location is defined",
|
|
500
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_trusted_named_location_exists (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
501
|
+
"evidenceType": "Configuration",
|
|
502
|
+
"severity": "low"
|
|
503
|
+
},
|
|
504
|
+
{
|
|
505
|
+
"id": "prowler.m365.entra_cross_tenant_access_default_outbound_restricted",
|
|
506
|
+
"title": "Default cross-tenant access policy restricts outbound B2B collaboration and direct connect",
|
|
507
|
+
"scope": "Prowler 5.47.0 check entra_cross_tenant_access_default_outbound_restricted (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
508
|
+
"evidenceType": "Configuration",
|
|
509
|
+
"severity": "medium"
|
|
510
|
+
},
|
|
175
511
|
{
|
|
176
512
|
"id": "prowler.m365.entra_default_app_management_policy_enabled",
|
|
177
513
|
"title": "Default app management policy enforces credential restrictions on applications and service principals",
|
|
178
|
-
"scope": "Prowler 5.
|
|
514
|
+
"scope": "Prowler 5.47.0 check entra_default_app_management_policy_enabled (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
179
515
|
"evidenceType": "Configuration",
|
|
180
516
|
"severity": "medium"
|
|
181
517
|
},
|
|
182
518
|
{
|
|
183
519
|
"id": "prowler.m365.entra_device_registration_global_admins_not_local_admins",
|
|
184
520
|
"title": "Global Administrators are not added as local administrators during Entra join",
|
|
185
|
-
"scope": "Prowler 5.
|
|
521
|
+
"scope": "Prowler 5.47.0 check entra_device_registration_global_admins_not_local_admins (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
522
|
+
"evidenceType": "Configuration",
|
|
523
|
+
"severity": "medium"
|
|
524
|
+
},
|
|
525
|
+
{
|
|
526
|
+
"id": "prowler.m365.entra_device_registration_join_restricted",
|
|
527
|
+
"title": "Users allowed to join devices to Microsoft Entra are restricted",
|
|
528
|
+
"scope": "Prowler 5.47.0 check entra_device_registration_join_restricted (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
186
529
|
"evidenceType": "Configuration",
|
|
187
530
|
"severity": "medium"
|
|
188
531
|
},
|
|
189
532
|
{
|
|
190
533
|
"id": "prowler.m365.entra_device_registration_laps_enabled",
|
|
191
534
|
"title": "Microsoft Entra Local Administrator Password Solution (LAPS) is enabled",
|
|
192
|
-
"scope": "Prowler 5.
|
|
535
|
+
"scope": "Prowler 5.47.0 check entra_device_registration_laps_enabled (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
193
536
|
"evidenceType": "Configuration",
|
|
194
537
|
"severity": "medium"
|
|
195
538
|
},
|
|
539
|
+
{
|
|
540
|
+
"id": "prowler.m365.entra_device_registration_max_devices_per_user_limited",
|
|
541
|
+
"title": "Maximum number of devices per user is limited",
|
|
542
|
+
"scope": "Prowler 5.47.0 check entra_device_registration_max_devices_per_user_limited (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
543
|
+
"evidenceType": "Configuration",
|
|
544
|
+
"severity": "low"
|
|
545
|
+
},
|
|
196
546
|
{
|
|
197
547
|
"id": "prowler.m365.entra_device_registration_registering_user_not_local_admin",
|
|
198
548
|
"title": "Registering user is not added as local administrator during Entra join",
|
|
199
|
-
"scope": "Prowler 5.
|
|
549
|
+
"scope": "Prowler 5.47.0 check entra_device_registration_registering_user_not_local_admin (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
550
|
+
"evidenceType": "Configuration",
|
|
551
|
+
"severity": "medium"
|
|
552
|
+
},
|
|
553
|
+
{
|
|
554
|
+
"id": "prowler.m365.entra_directory_sync_object_takeover_blocked",
|
|
555
|
+
"title": "Microsoft Entra directory sync must block object takeover (soft- and hard-matching)",
|
|
556
|
+
"scope": "Prowler 5.47.0 check entra_directory_sync_object_takeover_blocked (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
200
557
|
"evidenceType": "Configuration",
|
|
201
558
|
"severity": "medium"
|
|
202
559
|
},
|
|
203
560
|
{
|
|
204
561
|
"id": "prowler.m365.entra_dynamic_group_for_guests_created",
|
|
205
562
|
"title": "A dynamic membership group for guest users exists",
|
|
206
|
-
"scope": "Prowler 5.
|
|
563
|
+
"scope": "Prowler 5.47.0 check entra_dynamic_group_for_guests_created (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
207
564
|
"evidenceType": "Configuration",
|
|
208
565
|
"severity": "low"
|
|
209
566
|
},
|
|
567
|
+
{
|
|
568
|
+
"id": "prowler.m365.entra_dynamic_group_member_of_rule_not_used",
|
|
569
|
+
"title": "Dynamic group rules prevent stale access by avoiding the retiring memberOf operator",
|
|
570
|
+
"scope": "Prowler 5.47.0 check entra_dynamic_group_member_of_rule_not_used (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
571
|
+
"evidenceType": "Configuration",
|
|
572
|
+
"severity": "medium"
|
|
573
|
+
},
|
|
574
|
+
{
|
|
575
|
+
"id": "prowler.m365.entra_emergency_access_exclusion",
|
|
576
|
+
"title": "Emergency access exclusions prevent lockout from Conditional Access policies",
|
|
577
|
+
"scope": "Prowler 5.47.0 check entra_emergency_access_exclusion (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
578
|
+
"evidenceType": "Configuration",
|
|
579
|
+
"severity": "high"
|
|
580
|
+
},
|
|
210
581
|
{
|
|
211
582
|
"id": "prowler.m365.entra_identity_protection_sign_in_risk_enabled",
|
|
212
583
|
"title": "At least one Conditional Access Identity Protection sign-in risk policy protects against high and medium risk sign-ins",
|
|
213
|
-
"scope": "Prowler 5.
|
|
584
|
+
"scope": "Prowler 5.47.0 check entra_identity_protection_sign_in_risk_enabled (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
214
585
|
"evidenceType": "Configuration",
|
|
215
586
|
"severity": "high"
|
|
216
587
|
},
|
|
217
588
|
{
|
|
218
589
|
"id": "prowler.m365.entra_identity_protection_user_risk_enabled",
|
|
219
590
|
"title": "At least one Conditional Access policy enforces Identity Protection user risk for high-risk users",
|
|
220
|
-
"scope": "Prowler 5.
|
|
591
|
+
"scope": "Prowler 5.47.0 check entra_identity_protection_user_risk_enabled (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
221
592
|
"evidenceType": "Configuration",
|
|
222
593
|
"severity": "high"
|
|
223
594
|
},
|
|
595
|
+
{
|
|
596
|
+
"id": "prowler.m365.entra_idle_session_timeout_configured",
|
|
597
|
+
"title": "Idle session timeout of 3 hours or less is configured",
|
|
598
|
+
"scope": "Prowler 5.47.0 check entra_idle_session_timeout_configured (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
599
|
+
"evidenceType": "Configuration",
|
|
600
|
+
"severity": "medium"
|
|
601
|
+
},
|
|
224
602
|
{
|
|
225
603
|
"id": "prowler.m365.entra_intune_enrollment_sign_in_frequency_every_time",
|
|
226
604
|
"title": "Conditional Access requires strong authentication and Every Time sign-in frequency for Intune Enrollment",
|
|
227
|
-
"scope": "Prowler 5.
|
|
605
|
+
"scope": "Prowler 5.47.0 check entra_intune_enrollment_sign_in_frequency_every_time (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
228
606
|
"evidenceType": "Configuration",
|
|
229
607
|
"severity": "high"
|
|
230
608
|
},
|
|
609
|
+
{
|
|
610
|
+
"id": "prowler.m365.entra_legacy_authentication_blocked",
|
|
611
|
+
"title": "At least one Conditional Access policy blocks legacy authentication",
|
|
612
|
+
"scope": "Prowler 5.47.0 check entra_legacy_authentication_blocked (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
613
|
+
"evidenceType": "Configuration",
|
|
614
|
+
"severity": "critical"
|
|
615
|
+
},
|
|
231
616
|
{
|
|
232
617
|
"id": "prowler.m365.entra_managed_device_required_for_authentication",
|
|
233
618
|
"title": "Conditional Access policies require authentication from a managed device for all users and applications",
|
|
234
|
-
"scope": "Prowler 5.
|
|
619
|
+
"scope": "Prowler 5.47.0 check entra_managed_device_required_for_authentication (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
620
|
+
"evidenceType": "Configuration",
|
|
621
|
+
"severity": "high"
|
|
622
|
+
},
|
|
623
|
+
{
|
|
624
|
+
"id": "prowler.m365.entra_managed_device_required_for_mfa_registration",
|
|
625
|
+
"title": "Tenant has a Conditional Access policy that requires a managed device for MFA registration for all users",
|
|
626
|
+
"scope": "Prowler 5.47.0 check entra_managed_device_required_for_mfa_registration (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
235
627
|
"evidenceType": "Configuration",
|
|
236
628
|
"severity": "high"
|
|
237
629
|
},
|
|
630
|
+
{
|
|
631
|
+
"id": "prowler.m365.entra_password_hash_sync_enabled",
|
|
632
|
+
"title": "Organization has password hash synchronization enabled for hybrid deployments",
|
|
633
|
+
"scope": "Prowler 5.47.0 check entra_password_hash_sync_enabled (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
634
|
+
"evidenceType": "Configuration",
|
|
635
|
+
"severity": "medium"
|
|
636
|
+
},
|
|
238
637
|
{
|
|
239
638
|
"id": "prowler.m365.entra_password_protection_custom_banned_list_enforced",
|
|
240
639
|
"title": "Entra custom banned password list is enforced",
|
|
241
|
-
"scope": "Prowler 5.
|
|
640
|
+
"scope": "Prowler 5.47.0 check entra_password_protection_custom_banned_list_enforced (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
242
641
|
"evidenceType": "Configuration",
|
|
243
642
|
"severity": "medium"
|
|
244
643
|
},
|
|
245
644
|
{
|
|
246
645
|
"id": "prowler.m365.entra_password_protection_lockout_duration_configured",
|
|
247
646
|
"title": "Smart lockout duration is set to 60 seconds or more",
|
|
248
|
-
"scope": "Prowler 5.
|
|
647
|
+
"scope": "Prowler 5.47.0 check entra_password_protection_lockout_duration_configured (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
249
648
|
"evidenceType": "Configuration",
|
|
250
649
|
"severity": "low"
|
|
251
650
|
},
|
|
252
651
|
{
|
|
253
652
|
"id": "prowler.m365.entra_password_protection_lockout_threshold_limited",
|
|
254
653
|
"title": "Smart lockout threshold is set to 10 or less",
|
|
255
|
-
"scope": "Prowler 5.
|
|
654
|
+
"scope": "Prowler 5.47.0 check entra_password_protection_lockout_threshold_limited (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
256
655
|
"evidenceType": "Configuration",
|
|
257
656
|
"severity": "medium"
|
|
258
657
|
},
|
|
259
658
|
{
|
|
260
659
|
"id": "prowler.m365.entra_password_protection_on_premises_enforced",
|
|
261
660
|
"title": "Entra password protection is enforced on on-premises Active Directory",
|
|
262
|
-
"scope": "Prowler 5.
|
|
661
|
+
"scope": "Prowler 5.47.0 check entra_password_protection_on_premises_enforced (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
263
662
|
"evidenceType": "Configuration",
|
|
264
663
|
"severity": "medium"
|
|
265
664
|
},
|
|
266
665
|
{
|
|
267
666
|
"id": "prowler.m365.entra_pim_global_administrator_approval_required",
|
|
268
667
|
"title": "PIM requires approval to activate the Global Administrator role",
|
|
269
|
-
"scope": "Prowler 5.
|
|
668
|
+
"scope": "Prowler 5.47.0 check entra_pim_global_administrator_approval_required (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
270
669
|
"evidenceType": "Configuration",
|
|
271
670
|
"severity": "high"
|
|
272
671
|
},
|
|
273
672
|
{
|
|
274
673
|
"id": "prowler.m365.entra_pim_privileged_role_administrator_approval_required",
|
|
275
674
|
"title": "PIM requires approval to activate the Privileged Role Administrator role",
|
|
276
|
-
"scope": "Prowler 5.
|
|
675
|
+
"scope": "Prowler 5.47.0 check entra_pim_privileged_role_administrator_approval_required (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
277
676
|
"evidenceType": "Configuration",
|
|
278
677
|
"severity": "high"
|
|
279
678
|
},
|
|
679
|
+
{
|
|
680
|
+
"id": "prowler.m365.entra_policy_admin_self_service_password_reset_disabled",
|
|
681
|
+
"title": "Disabled Self-Service Password Reset protects administrator accounts from unauthorized recovery",
|
|
682
|
+
"scope": "Prowler 5.47.0 check entra_policy_admin_self_service_password_reset_disabled (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
683
|
+
"evidenceType": "Configuration",
|
|
684
|
+
"severity": "medium"
|
|
685
|
+
},
|
|
280
686
|
{
|
|
281
687
|
"id": "prowler.m365.entra_policy_default_user_cannot_create_m365_groups",
|
|
282
688
|
"title": "Non-admin users cannot create Microsoft 365 groups",
|
|
283
|
-
"scope": "Prowler 5.
|
|
689
|
+
"scope": "Prowler 5.47.0 check entra_policy_default_user_cannot_create_m365_groups (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
284
690
|
"evidenceType": "Configuration",
|
|
285
691
|
"severity": "medium"
|
|
286
692
|
},
|
|
287
693
|
{
|
|
288
694
|
"id": "prowler.m365.entra_policy_default_user_cannot_create_security_groups",
|
|
289
695
|
"title": "Non-admin users cannot create security groups",
|
|
290
|
-
"scope": "Prowler 5.
|
|
696
|
+
"scope": "Prowler 5.47.0 check entra_policy_default_user_cannot_create_security_groups (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
291
697
|
"evidenceType": "Configuration",
|
|
292
698
|
"severity": "medium"
|
|
293
699
|
},
|
|
294
700
|
{
|
|
295
701
|
"id": "prowler.m365.entra_policy_default_user_cannot_read_bitlocker_keys",
|
|
296
702
|
"title": "Non-admin users cannot read BitLocker keys for their owned devices",
|
|
297
|
-
"scope": "Prowler 5.
|
|
703
|
+
"scope": "Prowler 5.47.0 check entra_policy_default_user_cannot_read_bitlocker_keys (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
704
|
+
"evidenceType": "Configuration",
|
|
705
|
+
"severity": "medium"
|
|
706
|
+
},
|
|
707
|
+
{
|
|
708
|
+
"id": "prowler.m365.entra_policy_ensure_default_user_cannot_create_tenants",
|
|
709
|
+
"title": "Tenant restricts non-admin users from creating tenants",
|
|
710
|
+
"scope": "Prowler 5.47.0 check entra_policy_ensure_default_user_cannot_create_tenants (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
711
|
+
"evidenceType": "Configuration",
|
|
712
|
+
"severity": "medium"
|
|
713
|
+
},
|
|
714
|
+
{
|
|
715
|
+
"id": "prowler.m365.entra_policy_guest_invitations_restricted_to_allowed_domains",
|
|
716
|
+
"title": "Guest invitations are restricted to an allow-list of domains",
|
|
717
|
+
"scope": "Prowler 5.47.0 check entra_policy_guest_invitations_restricted_to_allowed_domains (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
298
718
|
"evidenceType": "Configuration",
|
|
299
719
|
"severity": "medium"
|
|
300
720
|
},
|
|
301
721
|
{
|
|
302
722
|
"id": "prowler.m365.entra_policy_guest_invite_only_for_admin_roles",
|
|
303
723
|
"title": "Tenant guest invitations are restricted to specific admin roles or disabled",
|
|
304
|
-
"scope": "Prowler 5.
|
|
724
|
+
"scope": "Prowler 5.47.0 check entra_policy_guest_invite_only_for_admin_roles (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
305
725
|
"evidenceType": "Configuration",
|
|
306
726
|
"severity": "high"
|
|
307
727
|
},
|
|
308
728
|
{
|
|
309
729
|
"id": "prowler.m365.entra_policy_guest_users_access_restrictions",
|
|
310
730
|
"title": "Authorization policy restricts guest user access to properties and memberships of their own directory objects",
|
|
311
|
-
"scope": "Prowler 5.
|
|
731
|
+
"scope": "Prowler 5.47.0 check entra_policy_guest_users_access_restrictions (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
732
|
+
"evidenceType": "Configuration",
|
|
733
|
+
"severity": "medium"
|
|
734
|
+
},
|
|
735
|
+
{
|
|
736
|
+
"id": "prowler.m365.entra_policy_msol_powershell_blocked",
|
|
737
|
+
"title": "Tenant blocks the legacy MSOnline (MSOL) PowerShell module",
|
|
738
|
+
"scope": "Prowler 5.47.0 check entra_policy_msol_powershell_blocked (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
739
|
+
"evidenceType": "Configuration",
|
|
740
|
+
"severity": "medium"
|
|
741
|
+
},
|
|
742
|
+
{
|
|
743
|
+
"id": "prowler.m365.entra_policy_restricts_user_consent_for_apps",
|
|
744
|
+
"title": "User consent for applications is set to 'Do not allow user consent'",
|
|
745
|
+
"scope": "Prowler 5.47.0 check entra_policy_restricts_user_consent_for_apps (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
746
|
+
"evidenceType": "Configuration",
|
|
747
|
+
"severity": "high"
|
|
748
|
+
},
|
|
749
|
+
{
|
|
750
|
+
"id": "prowler.m365.entra_seamless_sso_disabled",
|
|
751
|
+
"title": "Hybrid deployment does not have Seamless SSO enabled",
|
|
752
|
+
"scope": "Prowler 5.47.0 check entra_seamless_sso_disabled (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
312
753
|
"evidenceType": "Configuration",
|
|
313
754
|
"severity": "medium"
|
|
314
755
|
},
|
|
315
756
|
{
|
|
316
757
|
"id": "prowler.m365.entra_service_principal_no_secrets_for_permanent_tier0_roles",
|
|
317
758
|
"title": "Secure credential management prevents client secret usage for service principals with permanent Tier 0 roles",
|
|
318
|
-
"scope": "Prowler 5.
|
|
759
|
+
"scope": "Prowler 5.47.0 check entra_service_principal_no_secrets_for_permanent_tier0_roles (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
319
760
|
"evidenceType": "Configuration",
|
|
320
761
|
"severity": "critical"
|
|
321
762
|
},
|
|
322
763
|
{
|
|
323
764
|
"id": "prowler.m365.entra_service_principal_privileged_role_no_owners",
|
|
324
765
|
"title": "Service principals with privileged Entra directory roles must have no owners",
|
|
325
|
-
"scope": "Prowler 5.
|
|
766
|
+
"scope": "Prowler 5.47.0 check entra_service_principal_privileged_role_no_owners (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
326
767
|
"evidenceType": "Configuration",
|
|
327
768
|
"severity": "critical"
|
|
328
769
|
},
|
|
770
|
+
{
|
|
771
|
+
"id": "prowler.m365.entra_thirdparty_integrated_apps_not_allowed",
|
|
772
|
+
"title": "Authorization policy disallows app creation by non-admin users",
|
|
773
|
+
"scope": "Prowler 5.47.0 check entra_thirdparty_integrated_apps_not_allowed (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
774
|
+
"evidenceType": "Configuration",
|
|
775
|
+
"severity": "high"
|
|
776
|
+
},
|
|
777
|
+
{
|
|
778
|
+
"id": "prowler.m365.entra_users_mfa_capable",
|
|
779
|
+
"title": "User is MFA capable",
|
|
780
|
+
"scope": "Prowler 5.47.0 check entra_users_mfa_capable (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
781
|
+
"evidenceType": "Configuration",
|
|
782
|
+
"severity": "high"
|
|
783
|
+
},
|
|
784
|
+
{
|
|
785
|
+
"id": "prowler.m365.entra_users_mfa_enabled",
|
|
786
|
+
"title": "Multifactor authentication is enforced for all users",
|
|
787
|
+
"scope": "Prowler 5.47.0 check entra_users_mfa_enabled (Microsoft 365 entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
788
|
+
"evidenceType": "Configuration",
|
|
789
|
+
"severity": "critical"
|
|
790
|
+
},
|
|
791
|
+
{
|
|
792
|
+
"id": "prowler.m365.exchange_application_access_policy_restricts_mailbox_apps",
|
|
793
|
+
"title": "Apps with Exchange mailbox permissions must be scoped via Application Access Policy",
|
|
794
|
+
"scope": "Prowler 5.47.0 check exchange_application_access_policy_restricts_mailbox_apps (Microsoft 365 exchange, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
795
|
+
"evidenceType": "Configuration",
|
|
796
|
+
"severity": "medium"
|
|
797
|
+
},
|
|
798
|
+
{
|
|
799
|
+
"id": "prowler.m365.exchange_external_email_tagging_enabled",
|
|
800
|
+
"title": "Identity has external sender tagging enabled",
|
|
801
|
+
"scope": "Prowler 5.47.0 check exchange_external_email_tagging_enabled (Microsoft 365 exchange, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
802
|
+
"evidenceType": "Configuration",
|
|
803
|
+
"severity": "medium"
|
|
804
|
+
},
|
|
329
805
|
{
|
|
330
806
|
"id": "prowler.m365.exchange_mailbox_audit_bypass_disabled",
|
|
331
807
|
"title": "Mailbox has AuditBypassEnabled disabled",
|
|
332
|
-
"scope": "Prowler 5.
|
|
808
|
+
"scope": "Prowler 5.47.0 check exchange_mailbox_audit_bypass_disabled (Microsoft 365 exchange, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
333
809
|
"evidenceType": "Configuration",
|
|
334
810
|
"severity": "high"
|
|
335
811
|
},
|
|
812
|
+
{
|
|
813
|
+
"id": "prowler.m365.exchange_mailbox_policy_additional_storage_restricted",
|
|
814
|
+
"title": "Mailbox policy has additional storage providers disabled",
|
|
815
|
+
"scope": "Prowler 5.47.0 check exchange_mailbox_policy_additional_storage_restricted (Microsoft 365 exchange, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
816
|
+
"evidenceType": "Configuration",
|
|
817
|
+
"severity": "high"
|
|
818
|
+
},
|
|
819
|
+
{
|
|
820
|
+
"id": "prowler.m365.exchange_mailbox_primary_smtp_uses_custom_domain",
|
|
821
|
+
"title": "Mailbox primary SMTP address must use a custom domain",
|
|
822
|
+
"scope": "Prowler 5.47.0 check exchange_mailbox_primary_smtp_uses_custom_domain (Microsoft 365 exchange, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
823
|
+
"evidenceType": "Configuration",
|
|
824
|
+
"severity": "low"
|
|
825
|
+
},
|
|
826
|
+
{
|
|
827
|
+
"id": "prowler.m365.exchange_organization_delicensing_resiliency_enabled",
|
|
828
|
+
"title": "Delicensing Resiliency protects Exchange Online mailboxes from immediate access loss during license changes",
|
|
829
|
+
"scope": "Prowler 5.47.0 check exchange_organization_delicensing_resiliency_enabled (Microsoft 365 exchange, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
830
|
+
"evidenceType": "Configuration",
|
|
831
|
+
"severity": "medium"
|
|
832
|
+
},
|
|
336
833
|
{
|
|
337
834
|
"id": "prowler.m365.exchange_organization_mailbox_auditing_enabled",
|
|
338
835
|
"title": "Organization has mailbox auditing enabled",
|
|
339
|
-
"scope": "Prowler 5.
|
|
836
|
+
"scope": "Prowler 5.47.0 check exchange_organization_mailbox_auditing_enabled (Microsoft 365 exchange, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
340
837
|
"evidenceType": "Configuration",
|
|
341
838
|
"severity": "high"
|
|
342
839
|
},
|
|
840
|
+
{
|
|
841
|
+
"id": "prowler.m365.exchange_organization_mailtips_enabled",
|
|
842
|
+
"title": "Organization has MailTips fully enabled",
|
|
843
|
+
"scope": "Prowler 5.47.0 check exchange_organization_mailtips_enabled (Microsoft 365 exchange, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
844
|
+
"evidenceType": "Configuration",
|
|
845
|
+
"severity": "medium"
|
|
846
|
+
},
|
|
343
847
|
{
|
|
344
848
|
"id": "prowler.m365.exchange_organization_modern_authentication_enabled",
|
|
345
849
|
"title": "Organization has Modern Authentication enabled",
|
|
346
|
-
"scope": "Prowler 5.
|
|
850
|
+
"scope": "Prowler 5.47.0 check exchange_organization_modern_authentication_enabled (Microsoft 365 exchange, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
347
851
|
"evidenceType": "Configuration",
|
|
348
852
|
"severity": "critical"
|
|
349
853
|
},
|
|
350
854
|
{
|
|
351
855
|
"id": "prowler.m365.exchange_organization_reject_direct_send_enabled",
|
|
352
856
|
"title": "Direct Send is rejected for the Exchange Online organization",
|
|
353
|
-
"scope": "Prowler 5.
|
|
857
|
+
"scope": "Prowler 5.47.0 check exchange_organization_reject_direct_send_enabled (Microsoft 365 exchange, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
858
|
+
"evidenceType": "Configuration",
|
|
859
|
+
"severity": "medium"
|
|
860
|
+
},
|
|
861
|
+
{
|
|
862
|
+
"id": "prowler.m365.exchange_owa_mailbox_policy_personal_accounts_disabled",
|
|
863
|
+
"title": "Default OWA mailbox policy disables personal account integration",
|
|
864
|
+
"scope": "Prowler 5.47.0 check exchange_owa_mailbox_policy_personal_accounts_disabled (Microsoft 365 exchange, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
354
865
|
"evidenceType": "Configuration",
|
|
355
866
|
"severity": "medium"
|
|
356
867
|
},
|
|
357
868
|
{
|
|
358
869
|
"id": "prowler.m365.exchange_roles_assignment_policy_addins_disabled",
|
|
359
870
|
"title": "Role assignment policy does not allow Outlook add-ins",
|
|
360
|
-
"scope": "Prowler 5.
|
|
871
|
+
"scope": "Prowler 5.47.0 check exchange_roles_assignment_policy_addins_disabled (Microsoft 365 exchange, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
361
872
|
"evidenceType": "Configuration",
|
|
362
873
|
"severity": "high"
|
|
363
874
|
},
|
|
364
875
|
{
|
|
365
876
|
"id": "prowler.m365.exchange_shared_mailbox_sign_in_disabled",
|
|
366
877
|
"title": "Shared mailbox has sign-in blocked",
|
|
367
|
-
"scope": "Prowler 5.
|
|
878
|
+
"scope": "Prowler 5.47.0 check exchange_shared_mailbox_sign_in_disabled (Microsoft 365 exchange, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
368
879
|
"evidenceType": "Configuration",
|
|
369
880
|
"severity": "medium"
|
|
370
881
|
},
|
|
371
882
|
{
|
|
372
883
|
"id": "prowler.m365.exchange_transport_config_smtp_auth_disabled",
|
|
373
884
|
"title": "SMTP AUTH is disabled in the Exchange Online Transport Configuration",
|
|
374
|
-
"scope": "Prowler 5.
|
|
885
|
+
"scope": "Prowler 5.47.0 check exchange_transport_config_smtp_auth_disabled (Microsoft 365 exchange, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
886
|
+
"evidenceType": "Configuration",
|
|
887
|
+
"severity": "high"
|
|
888
|
+
},
|
|
889
|
+
{
|
|
890
|
+
"id": "prowler.m365.exchange_transport_rules_mail_forwarding_disabled",
|
|
891
|
+
"title": "Transport rule does not allow forwarding mail to external domains",
|
|
892
|
+
"scope": "Prowler 5.47.0 check exchange_transport_rules_mail_forwarding_disabled (Microsoft 365 exchange, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
893
|
+
"evidenceType": "Configuration",
|
|
894
|
+
"severity": "high"
|
|
895
|
+
},
|
|
896
|
+
{
|
|
897
|
+
"id": "prowler.m365.exchange_transport_rules_whitelist_disabled",
|
|
898
|
+
"title": "Transport rule does not whitelist any domains",
|
|
899
|
+
"scope": "Prowler 5.47.0 check exchange_transport_rules_whitelist_disabled (Microsoft 365 exchange, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
375
900
|
"evidenceType": "Configuration",
|
|
376
901
|
"severity": "high"
|
|
377
902
|
},
|
|
378
903
|
{
|
|
379
904
|
"id": "prowler.m365.exchange_user_mailbox_auditing_enabled",
|
|
380
905
|
"title": "User mailbox auditing is enabled with required Admin, Delegate, and Owner actions and audit log age meets the minimum",
|
|
381
|
-
"scope": "Prowler 5.
|
|
906
|
+
"scope": "Prowler 5.47.0 check exchange_user_mailbox_auditing_enabled (Microsoft 365 exchange, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
907
|
+
"evidenceType": "Configuration",
|
|
908
|
+
"severity": "high"
|
|
909
|
+
},
|
|
910
|
+
{
|
|
911
|
+
"id": "prowler.m365.intune_device_compliance_policy_unassigned_devices_not_compliant_by_default",
|
|
912
|
+
"title": "Built-in Device Compliance Policy marks devices without an assigned compliance policy as Not compliant by default",
|
|
913
|
+
"scope": "Prowler 5.47.0 check intune_device_compliance_policy_unassigned_devices_not_compliant_by_default (Microsoft 365 intune, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
382
914
|
"evidenceType": "Configuration",
|
|
383
915
|
"severity": "high"
|
|
384
916
|
},
|
|
385
917
|
{
|
|
386
918
|
"id": "prowler.m365.purview_audit_log_search_enabled",
|
|
387
919
|
"title": "Purview audit log search is enabled",
|
|
388
|
-
"scope": "Prowler 5.
|
|
920
|
+
"scope": "Prowler 5.47.0 check purview_audit_log_search_enabled (Microsoft 365 purview, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
389
921
|
"evidenceType": "Configuration",
|
|
390
922
|
"severity": "critical"
|
|
391
923
|
},
|
|
924
|
+
{
|
|
925
|
+
"id": "prowler.m365.sharepoint_external_sharing_managed",
|
|
926
|
+
"title": "External sharing is restricted using a non-empty domain allowlist or blocklist",
|
|
927
|
+
"scope": "Prowler 5.47.0 check sharepoint_external_sharing_managed (Microsoft 365 sharepoint, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
928
|
+
"evidenceType": "Configuration",
|
|
929
|
+
"severity": "high"
|
|
930
|
+
},
|
|
931
|
+
{
|
|
932
|
+
"id": "prowler.m365.sharepoint_external_sharing_restricted",
|
|
933
|
+
"title": "Organization external sharing is set to Existing guests only, New and existing guests, or Disabled",
|
|
934
|
+
"scope": "Prowler 5.47.0 check sharepoint_external_sharing_restricted (Microsoft 365 sharepoint, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
935
|
+
"evidenceType": "Configuration",
|
|
936
|
+
"severity": "high"
|
|
937
|
+
},
|
|
938
|
+
{
|
|
939
|
+
"id": "prowler.m365.sharepoint_guest_sharing_restricted",
|
|
940
|
+
"title": "Guest users cannot share items they do not own",
|
|
941
|
+
"scope": "Prowler 5.47.0 check sharepoint_guest_sharing_restricted (Microsoft 365 sharepoint, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
942
|
+
"evidenceType": "Configuration",
|
|
943
|
+
"severity": "high"
|
|
944
|
+
},
|
|
392
945
|
{
|
|
393
946
|
"id": "prowler.m365.sharepoint_modern_authentication_required",
|
|
394
947
|
"title": "Requires modern authentication for applications",
|
|
395
|
-
"scope": "Prowler 5.
|
|
948
|
+
"scope": "Prowler 5.47.0 check sharepoint_modern_authentication_required (Microsoft 365 sharepoint, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
396
949
|
"evidenceType": "Configuration",
|
|
397
950
|
"severity": "high"
|
|
398
951
|
},
|
|
399
952
|
{
|
|
400
953
|
"id": "prowler.m365.sharepoint_onedrive_sync_restricted_unmanaged_devices",
|
|
401
954
|
"title": "OneDrive sync from unmanaged devices is blocked",
|
|
402
|
-
"scope": "Prowler 5.
|
|
955
|
+
"scope": "Prowler 5.47.0 check sharepoint_onedrive_sync_restricted_unmanaged_devices (Microsoft 365 sharepoint, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
403
956
|
"evidenceType": "Configuration",
|
|
404
957
|
"severity": "high"
|
|
405
958
|
},
|
|
406
959
|
{
|
|
407
960
|
"id": "prowler.m365.teams_email_sending_to_channel_disabled",
|
|
408
961
|
"title": "Email to Teams channel addresses is disabled",
|
|
409
|
-
"scope": "Prowler 5.
|
|
962
|
+
"scope": "Prowler 5.47.0 check teams_email_sending_to_channel_disabled (Microsoft 365 teams, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
963
|
+
"evidenceType": "Configuration",
|
|
964
|
+
"severity": "high"
|
|
965
|
+
},
|
|
966
|
+
{
|
|
967
|
+
"id": "prowler.m365.teams_external_access_trial_tenants_blocked",
|
|
968
|
+
"title": "External access with Teams trial-only tenants is blocked",
|
|
969
|
+
"scope": "Prowler 5.47.0 check teams_external_access_trial_tenants_blocked (Microsoft 365 teams, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
970
|
+
"evidenceType": "Configuration",
|
|
971
|
+
"severity": "high"
|
|
972
|
+
},
|
|
973
|
+
{
|
|
974
|
+
"id": "prowler.m365.teams_external_domains_restricted",
|
|
975
|
+
"title": "External domain access is disabled for Teams users",
|
|
976
|
+
"scope": "Prowler 5.47.0 check teams_external_domains_restricted (Microsoft 365 teams, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
410
977
|
"evidenceType": "Configuration",
|
|
411
978
|
"severity": "high"
|
|
412
979
|
},
|
|
413
980
|
{
|
|
414
981
|
"id": "prowler.m365.teams_external_file_sharing_restricted",
|
|
415
982
|
"title": "External file sharing is restricted to only approved cloud storage services",
|
|
416
|
-
"scope": "Prowler 5.
|
|
983
|
+
"scope": "Prowler 5.47.0 check teams_external_file_sharing_restricted (Microsoft 365 teams, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
417
984
|
"evidenceType": "Configuration",
|
|
418
985
|
"severity": "high"
|
|
419
986
|
},
|
|
420
987
|
{
|
|
421
988
|
"id": "prowler.m365.teams_external_users_cannot_start_conversations",
|
|
422
989
|
"title": "Users cannot start conversations with unmanaged accounts",
|
|
423
|
-
"scope": "Prowler 5.
|
|
990
|
+
"scope": "Prowler 5.47.0 check teams_external_users_cannot_start_conversations (Microsoft 365 teams, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
424
991
|
"evidenceType": "Configuration",
|
|
425
992
|
"severity": "critical"
|
|
426
993
|
},
|
|
427
994
|
{
|
|
428
995
|
"id": "prowler.m365.teams_meeting_anonymous_user_join_disabled",
|
|
429
996
|
"title": "Anonymous users cannot join Teams meetings",
|
|
430
|
-
"scope": "Prowler 5.
|
|
997
|
+
"scope": "Prowler 5.47.0 check teams_meeting_anonymous_user_join_disabled (Microsoft 365 teams, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
431
998
|
"evidenceType": "Configuration",
|
|
432
999
|
"severity": "critical"
|
|
433
1000
|
},
|
|
434
1001
|
{
|
|
435
1002
|
"id": "prowler.m365.teams_meeting_anonymous_user_start_disabled",
|
|
436
1003
|
"title": "Anonymous users cannot start Teams meetings",
|
|
437
|
-
"scope": "Prowler 5.
|
|
1004
|
+
"scope": "Prowler 5.47.0 check teams_meeting_anonymous_user_start_disabled (Microsoft 365 teams, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
438
1005
|
"evidenceType": "Configuration",
|
|
439
1006
|
"severity": "high"
|
|
440
1007
|
},
|
|
441
1008
|
{
|
|
442
1009
|
"id": "prowler.m365.teams_meeting_chat_anonymous_users_disabled",
|
|
443
1010
|
"title": "Meetings global policy does not allow anonymous users in meeting chat",
|
|
444
|
-
"scope": "Prowler 5.
|
|
1011
|
+
"scope": "Prowler 5.47.0 check teams_meeting_chat_anonymous_users_disabled (Microsoft 365 teams, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
445
1012
|
"evidenceType": "Configuration",
|
|
446
1013
|
"severity": "high"
|
|
447
1014
|
},
|
|
448
1015
|
{
|
|
449
1016
|
"id": "prowler.m365.teams_meeting_dial_in_lobby_bypass_disabled",
|
|
450
1017
|
"title": "Meetings global policy does not allow dial-in users to bypass the lobby",
|
|
451
|
-
"scope": "Prowler 5.
|
|
1018
|
+
"scope": "Prowler 5.47.0 check teams_meeting_dial_in_lobby_bypass_disabled (Microsoft 365 teams, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
452
1019
|
"evidenceType": "Configuration",
|
|
453
1020
|
"severity": "high"
|
|
454
1021
|
},
|
|
455
1022
|
{
|
|
456
1023
|
"id": "prowler.m365.teams_meeting_external_chat_disabled",
|
|
457
1024
|
"title": "Meeting chat for untrusted organizations is disabled",
|
|
458
|
-
"scope": "Prowler 5.
|
|
1025
|
+
"scope": "Prowler 5.47.0 check teams_meeting_external_chat_disabled (Microsoft 365 teams, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
459
1026
|
"evidenceType": "Configuration",
|
|
460
1027
|
"severity": "high"
|
|
461
1028
|
},
|
|
462
1029
|
{
|
|
463
1030
|
"id": "prowler.m365.teams_meeting_external_control_disabled",
|
|
464
1031
|
"title": "Meetings global policy prevents external participants from giving or requesting control",
|
|
465
|
-
"scope": "Prowler 5.
|
|
1032
|
+
"scope": "Prowler 5.47.0 check teams_meeting_external_control_disabled (Microsoft 365 teams, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
466
1033
|
"evidenceType": "Configuration",
|
|
467
1034
|
"severity": "high"
|
|
468
1035
|
},
|
|
469
1036
|
{
|
|
470
1037
|
"id": "prowler.m365.teams_meeting_external_lobby_bypass_disabled",
|
|
471
1038
|
"title": "Meetings global policy allows only people in the organization to bypass the lobby",
|
|
472
|
-
"scope": "Prowler 5.
|
|
1039
|
+
"scope": "Prowler 5.47.0 check teams_meeting_external_lobby_bypass_disabled (Microsoft 365 teams, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
473
1040
|
"evidenceType": "Configuration",
|
|
474
1041
|
"severity": "critical"
|
|
475
1042
|
},
|
|
476
1043
|
{
|
|
477
1044
|
"id": "prowler.m365.teams_meeting_presenters_restricted",
|
|
478
1045
|
"title": "Meetings org-wide default policy allows only organizers and co-organizers to present",
|
|
479
|
-
"scope": "Prowler 5.
|
|
1046
|
+
"scope": "Prowler 5.47.0 check teams_meeting_presenters_restricted (Microsoft 365 teams, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
480
1047
|
"evidenceType": "Configuration",
|
|
481
1048
|
"severity": "medium"
|
|
482
1049
|
},
|
|
483
1050
|
{
|
|
484
1051
|
"id": "prowler.m365.teams_meeting_recording_disabled",
|
|
485
1052
|
"title": "Meetings global (Org-wide default) policy has meeting recording disabled by default",
|
|
486
|
-
"scope": "Prowler 5.
|
|
1053
|
+
"scope": "Prowler 5.47.0 check teams_meeting_recording_disabled (Microsoft 365 teams, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1054
|
+
"evidenceType": "Configuration",
|
|
1055
|
+
"severity": "medium"
|
|
1056
|
+
},
|
|
1057
|
+
{
|
|
1058
|
+
"id": "prowler.m365.teams_security_reporting_enabled",
|
|
1059
|
+
"title": "Messaging policy has security reporting enabled",
|
|
1060
|
+
"scope": "Prowler 5.47.0 check teams_security_reporting_enabled (Microsoft 365 teams, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
487
1061
|
"evidenceType": "Configuration",
|
|
488
1062
|
"severity": "medium"
|
|
489
1063
|
},
|
|
490
1064
|
{
|
|
491
1065
|
"id": "prowler.m365.teams_unmanaged_communication_disabled",
|
|
492
1066
|
"title": "Users cannot communicate with unmanaged users",
|
|
493
|
-
"scope": "Prowler 5.
|
|
1067
|
+
"scope": "Prowler 5.47.0 check teams_unmanaged_communication_disabled (Microsoft 365 teams, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
494
1068
|
"evidenceType": "Configuration",
|
|
495
1069
|
"severity": "high"
|
|
496
1070
|
}
|