rules/findings/entra/devices/eid-ability-to-join-devices-not-restricted.json
|
{
"provider": "EntraID", "serviceType": "Devices", "serviceName": "Microsoft Entra ID", "displayName": "Ensure the ability to join devices to Entra is restricted", "description": "This setting enables you to select the users who can register their devices as Microsoft Entra joined devices.\r\nThe recommended state is \u0060Selected\u0060 or \u0060None\u0060.\r\nNote: This setting is applicable only to Microsoft Entra join on Windows 10 or newer. This setting doesn\u0027t apply to Microsoft Entra hybrid joined devices, Microsoft Entra joined VMs in Azure, or Microsoft Entra joined devices that use Windows Autopilot self\u0002deployment mode because these methods work in a userless context.", "rationale": "If a threat actor compromises a standard user account, they can enroll a rogue device under that user\u0027s identity. This device may inherit MDM policies and appear compliant, giving attackers persistent access to cloud resources without triggering MFA.\r\nIn a 2023 blog, Microsoft IR reports that it has detected threat actors registering their own devices to the Microsoft Entra tenant, giving them a platform to escalate the cyberattack. While simply joining a device to a Microsoft Entra tenant may present limited immediate risk, it could allow a threat actor to establish a foothold in the environment.", "impact": "Restricting the setting requires IT teams to assign enrollment permissions to specific staff, such as helpdesk or provisioning personnel, which may impact user-driven Autopilot scenarios and increase administrative overhead for device onboarding and support.", "remediation": { "text": "Remediate from Azure Portal\n\t\t\t1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/.\n\t\t\t2. Click to expand Entra ID \u003E Devices select Device settings.\n\t\t\t3. Set \u0060Users may join devices to Microsoft Entra\u0060 to \u0060Selected\u0060 (and add members) or \u0060None\u0060.\n\t\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/entra/identity/devices/manage-device-identities#configure-device-settings", "https://www.microsoft.com/en-us/security/blog/2023/12/05/microsoft-incident-response-lessons-on-preventing-cloud-identity-compromise/#poor-device", "https://learn.microsoft.com/en-us/graph/api/resources/deviceregistrationpolicy?view=graph-rest-beta" ], "compliance": [ { "name": "CIS Microsoft 365 Foundations Benchmark", "version": "7.0.0", "reference": "5.1.4.1", "profile": [ "E3 Level 2", "E5 Level 2" ] } ], "level": "medium", "tags": [], "rule": { "path": "aad_device_settings", "subPath": null, "selectCondition": [], "query": [ { "filter": [ { "conditions": [ [ "azureADJoin.allowedToJoin.@odata.type", "eq", "enumeratedDeviceRegistrationMembership" ], [ "azureADJoin.allowedToJoin.@odata.type", "eq", "noDeviceRegistrationMembership" ] ], "operator": "or" } ] } ], "shouldExist": true, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "displayName": "Display Name", "multiFactorAuthConfiguration": "Require MFA setting", "userDeviceQuota": "User Device Quota", "azureADJoin.allowedToJoin.@odata.type": "Type" }, "expandObject": null }, "table": "asList", "decorate": [], "emphasis": [ "Type" ], "actions": { "objectData": { "properties": [], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "displayName": "Display Name", "multiFactorAuthConfiguration": "Require MFA setting", "userDeviceQuota": "User Device Quota" }, "expandObject": null }, "status": { "keyName": [], "message": "Ensure the ability to join devices to Entra is restricted", "defaultMessage": "Ensure the ability to join devices to Entra is restricted" }, "properties": { "resourceName": "displayName", "resourceId": "id", "resourceType": "EntraDeviceRegistrationPolicy" }, "onlyStatus": false } }, "idSuffix": "eid_allow_to_join_devices_not_restricted", "notes": [], "categories": [], "immutableProperties": [ "id" ], "id": "entraid_tenant_003" } |