rules/findings/entra/conditional_access/eid-ensure-token-protection-missing-cap.json
|
{
"provider": "EntraID", "serviceType": "Conditional Access", "serviceName": "Microsoft Entra ID", "displayName": "Ensure a Token Protection Conditional Access policy is considered", "description": "This recommendation ensures that issued tokens are only issued to the intended device.", "rationale": "When properly configured, conditional access can aid in preventing attacks involving token theft, via hijacking or reply, as part of the attack flow. Although currently considered a rare event, the impact from token impersonation can be severe.", "impact": "A Microsoft Entra ID P1 or P2 license is required.\u003Cbr/\u003E\u003Cbr/\u003EStart with a Conditional Access policy in \u0022Report Only\u0022 mode prior to enforcing for all users.", "remediation": { "text": "\n\t\t\t###### Remediate from Azure Portal \n\t\t\t1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator. \n\t\t\t2. Browse to Protection \u003E Conditional Access \u003E Policies. \n\t\t\t3. Select New policy. \n\t\t\t4. Give your policy a name. \n\t\t\t5. Under Assignments, select Users or workload identities. \n\t\t\t\t1. Under Include, select the users or groups to apply this policy. \n\t\t\t\t2. Under Exclude, select Users and groups and choose your organization\u0027s emergency access or break-glass accounts (if applicable). \n\t\t\t6. Under Target resources \u003E Resources \u003E Include \u003E Select resources \n\t\t\t\t1. Under Select, select the following applications: \n\t\t\t\t\t1. Office 365 Exchange Online \n\t\t\t\t\t2. Office 365 SharePoint Online \n\t\t\t\t2. Choose Select \n\t\t\t7. Under Conditions: \n\t\t\t\t1. Under Device platforms \n\t\t\t\t\t1. Set Configure to Yes. \n\t\t\t\t\t2. Include \u003E Select device platforms \u003E Windows. \n\t\t\t\t\t3. Select Done. \n\t\t\t\t2. Under Client apps: \n\t\t\t\t\t1. Set Configure to Yes \n\t\t\t\t\t2. Under Modern authentication clients, only select Mobile apps and desktop clients. \n\t\t\t\t\t3. Select Done \n\t\t\t8. Under Access controls \u003E Session, select Require token protection for sign-in sessions and select Select. \n\t\t\t9. Confirm your settings and set Enable policy to On. \n\t\t\t10. Select Create to enable your policy.\n\t\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-tokenprotection", "https://www.microsoft.com/en-gb/security/business/microsoft-entra-pricingPage" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "5.0.0", "reference": "5.2.8", "profile": [ "Level 2" ] } ], "level": "medium", "tags": [], "rule": { "path": "", "subPath": null, "selectCondition": {}, "query": [ { "filter": [ { "conditions": [] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": {}, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": {}, "expandObject": null }, "status": { "keyName": [], "message": "", "defaultMessage": null }, "properties": { "resourceName": null, "resourceId": null, "resourceType": null }, "onlyStatus": false } }, "idSuffix": "entra_missing_token_protection_cap", "notes": [], "categories": [], "immutableProperties": [ "name", "id" ], "id": "" } |