rules/findings/entra/conditional_access/eid-trusted-location-enabled.json
|
{
"provider": "EntraID", "serviceType": "Conditional Access", "serviceName": "Microsoft Entra ID", "displayName": "Ensure Trusted Locations Are Defined", "description": "Microsoft Entra ID Conditional Access allows an organization to configure \u0060Named locations\u0060 and configure whether those locations are trusted or untrusted. These settings provide organizations the means to specify Geographical locations for use in conditional access policies, or define actual IP addresses and IP ranges and whether or not those IP addresses and/or ranges are trusted by the organization.", "rationale": "Defining trusted source IP addresses or ranges helps organizations create and enforce Conditional Access policies around those trusted or untrusted IP addresses and ranges. Users authenticating from trusted IP addresses and/or ranges may have less access restrictions or access requirements when compared to users that try to authenticate to Microsoft Entra ID from untrusted locations or untrusted source IP addresses/ranges. ", "impact": "\r\n\t\tWhen configuring \u0060Named locations\u0060, the organization can create locations using geographical location data or by defining source IP addresses or ranges. Configuring \u0060Named locations\u0060 using a Country location does not provide the organization the ability to mark those locations as trusted, and any Conditional Access policy relying on those \u0060Countries location\u0060 setting will not be able to use the All trusted locations setting within the Conditional Access policy. They instead will have to rely on the \u0060Select locations\u0060 setting. This may add additional resource requirements when configuring and will require thorough organizational testing. \r\n\t\tIn general, Conditional Access policies may completely prevent users from authenticating to Microsoft Entra ID, and thorough testing is recommended. To avoid complete lockout, a \u0027Break Glass\u0027 account with full Global Administrator rights is recommended in the event all other administrators are locked out of authenticating to Microsoft Entra ID. This \u0027Break Glass\u0027 account should be excluded from Conditional Access Policies and should be configured with the longest pass phrase feasible in addition to a FIDO2 security key or certificate kept in a very secure physical location. This account should only be used in the event of an emergency and complete administrator lockout.\r\n\t\t*NOTE:* Starting July 2024, Microsoft will begin requiring MFA for All Users - including Break Glass Accounts. By the end of October 2024, this requirement will be enforced. Physical FIDO2 security keys, or a certificate kept on secure removable storage can fulfill this MFA requirement. If opting for a physical device, that device should be kept in a very secure, documented physical location.\r\n ", "remediation": { "text": "\r\n\t\t###### Remediate from Azure Portal \u003Cbr/\u003E\r\n\r\n\t\t1. In the Azure Portal, navigate to \u0060Microsoft Entra ID\u0060 \r\n\t\t2. Under \u0060Manage\u0060, click \u0060Security\u0060 \r\n\t\t3. Under \u0060Protect\u0060, click \u0060Conditional Access\u0060 \r\n\t\t4. Under \u0060Manage\u0060, click \u0060Named locations\u0060 \r\n\t\t5. Within the \u0060Named locations\u0060 blade, click on \u0060IP ranges location\u0060 \r\n\t\t6. Enter a name for this location setting in the \u0060Name\u0060 text box \r\n\t\t7. Click on the \u0060\u002B\u0060 sign \r\n\t\t8. Add an IP Address Range in CIDR notation inside the text box that appears \r\n\t\t9. Click on the \u0060Add\u0060 button \r\n\t\t10. Repeat steps 7 through 9 for each IP Range that needs to be added \r\n\t\t11. If the information entered are trusted ranges, select the \u0060Mark as trusted location\u0060 check box \r\n\t\t12. Once finished, click on \u0060Create\u0060\r\n\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-assignment-network", "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-identity-management#im-7-restrict-resource-access-based-on--conditions", "https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "5.0.0", "reference": "5.2.1", "profile": [ "Level 2" ] } ], "level": "medium", "tags": [], "rule": { "path": "", "subPath": null, "selectCondition": {}, "query": [], "shouldExist": "true", "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": {}, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [ "*" ], "expandObject": "", "limit": null }, "showGoToButton": "False", "showModalButton": "False", "directLink": null } }, "text": { "data": { "properties": {}, "expandObject": "" }, "status": { "keyName": [], "message": "", "defaultMessage": "Ensure Trusted Locations Are Defined" }, "properties": {}, "onlyStatus": true } }, "idSuffix": "eid_trusted_location_defined", "notes": [], "categories": [], "immutableProperties": [], "id": "entraid_1114" } |