rules/findings/old/entraid/IAM/CIS3.1/eid-ensure-admin-accounts-are-not-used-for-daily-operations.json
|
{
"args": [], "provider": "EntraID", "serviceType": "Entra Role Assignment", "serviceName": "Microsoft Entra ID", "displayName": "Ensure that Azure admin accounts are not used for daily operations", "description": "Microsoft Azure admin accounts should not be used for routine, non-administrative tasks.", "rationale": "Using admin accounts for daily operations increases the risk of accidental misconfigurations and security breaches.", "impact": "Minor administrative overhead includes managing separate accounts, enforcing stricter access controls, and potential licensing costs for advanced security features.", "remediation": { "text": " If admin accounts are being used for daily operations, consider the following: * Monitor and alert on unusual activity. * Enforce the principle of least privilege. * Revoke any unnecessary administrative access. * Use Conditional Access to limit access to resources. * Ensure that administrators have separate admin and user accounts. * Use Microsoft Entra ID Protection to detect, investigate, and remediate identity- based risks. * Use Privileged Identity Management (PIM) in Microsoft Entra ID to limit standing administrator access to privileged roles, discover who has access, and review privileged access. ", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/entra/architecture/protect-m365-from-on-premises-attacks" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "5.0.0", "reference": "5.3.1", "profile": [ "Level 1" ] } ], "level": "medium", "tags": [], "rule": { "path": "aad_signIn_logs_rbac", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "include": "_ARG_0_" } ] }, { "connectOperator": "and", "filter": [ { "conditions": [ [ "ne", "createdDateTime" ] ] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "id": "Id", "userPrincipalName": "User Principal Name", "displayName": "Display Name", "roleName": "Role Assigned", "createdDateTime": "Date" } }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "id": "Id", "userPrincipalName": "User Principal Name", "displayName": "Display Name", "roleName": "Role Assigned", "createdDateTime": "Date" } }, "status": { "keyName": [ "userPrincipalName" ], "message": "The {userPrincipalName} admin account was used for daily operations", "defaultMessage": null }, "properties": { "resourceName": "userPrincipalName", "resourceId": "id", "resourceType": "EntraUser" }, "onlyStatus": false } }, "idSuffix": "azure_accounts_used_daily_operations", "notes": [], "categories": [], "immutable_properties": [ "userPrincipalName", "id" ], "id": "" } |