rules/findings/entra/iam/eid-ensure-admin-accounts-are-not-used-for-daily-operations.json
|
{
"provider": "EntraID", "serviceType": "Entra Role Assignment", "serviceName": "Microsoft Entra ID", "displayName": "Ensure that Azure admin accounts are not used for daily operations", "description": "Microsoft Azure admin accounts should not be used for routine, non-administrative tasks.", "rationale": "Using admin accounts for daily operations increases the risk of accidental misconfigurations and security breaches.", "impact": "Minor administrative overhead includes managing separate accounts, enforcing stricter access controls, and potential licensing costs for advanced security features.", "remediation": { "text": "\n\t\t\tIf admin accounts are being used for daily operations, consider the following: \n\t\t\t* Monitor and alert on unusual activity. \n\t\t\t* Enforce the principle of least privilege. \n\t\t\t* Revoke any unnecessary administrative access. \n\t\t\t* Use Conditional Access to limit access to resources. \n\t\t\t* Ensure that administrators have separate admin and user accounts. \n\t\t\t* Use Microsoft Entra ID Protection to detect, investigate, and remediate identity- based risks.\n\t\t\t* Use Privileged Identity Management (PIM) in Microsoft Entra ID to limit standing administrator access to privileged roles, discover who has access, and review privileged access.\n\t\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/entra/architecture/protect-m365-from-on-premises-attacks" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "5.0.0", "reference": "5.3.1", "profile": [ "Level 1" ] } ], "level": "medium", "tags": [], "rule": { "path": "aad_signIn_logs_rbac", "subPath": null, "selectCondition": {}, "query": [ { "filter": [ { "include": "_ARG_0_" } ] }, { "connectOperator": "and", "filter": [ { "conditions": [ [ "ne", "createdDateTime" ] ] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "id": "Id", "userPrincipalName": "User Principal Name", "displayName": "Display Name", "roleName": "Role Assigned", "createdDateTime": "Date" } }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "id": "Id", "userPrincipalName": "User Principal Name", "displayName": "Display Name", "roleName": "Role Assigned", "createdDateTime": "Date" } }, "status": { "keyName": [ "userPrincipalName" ], "message": "The {userPrincipalName} admin account was used for daily operations", "defaultMessage": null }, "properties": { "resourceName": "userPrincipalName", "resourceId": "id", "resourceType": "EntraUser" }, "onlyStatus": false } }, "idSuffix": "azure_accounts_used_daily_operations", "notes": [], "categories": [], "immutableProperties": [ "userPrincipalName", "id" ], "id": "" } |