Feature/1.3.7 third party storage - #316
Conversation
Preview EnvironmentA preview environment can be spun up on demand for this PR.
|
CI: Engine
One or more checks failed. View logs |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8e91010a96
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| } | ||
|
|
||
| total_policies := object.get(input, "total_policies", 0) | ||
| policies_with_external_storage := object.get(input, "policies_with_external_storage", []) |
There was a problem hiding this comment.
For tenants where every OWA mailbox policy has AdditionalStorageProvidersAvailable disabled but the Microsoft 365 on-the-web third-party storage service is still enabled, this rule returns compliant. CIS 1.3.7 is the Microsoft 365 admin-center/Graph service-principal setting (for example, the documented remediation disables appId c1f33bc0-bdb4-4248-ba9b-096807ddb43e), while this policy evaluates the OWA collector field already used for the separate 6.5.3 Outlook-on-the-web recommendation, so marking 1.3.7 ready here can produce false compliance results. See: https://maester.dev/docs/tests/CIS.M365.1.3.7/
Useful? React with 👍 / 👎.
| @@ -0,0 +1,25 @@ | |||
| package cis.microsoft_365_foundations.v6_0_0.control_1_3_6 | |||
There was a problem hiding this comment.
In this commit, control 1.3.6 still remains automation_status: "not_started" with policy_file: null in metadata.json, so adding this .rego file leaves it orphaned. The existing CI wiring test test_no_orphaned_rego_files enumerates every *.rego under the version directory and will fail on 1.3.6_customer_lockbox_enabled.rego, and the worker cannot run the policy until metadata references it.
Useful? React with 👍 / 👎.
1 participant
Summary
Implements CIS Microsoft 365 Foundations control 1.3.7 (Ensure 'third-party storage services' are restricted in 'Microsoft 365 on the web'). Adds the Rego policy and unit tests; no collector changes were needed as the existing collector already returns the required field.
Type of Change
Affected Components
/engine(collectors / policies)Motivation
Control 1.3.7 was listed in metadata.json with automation_status "not_started" — the collector (exchange.organization.owa_mailbox_policy) existed but no Rego policy had been written. Picked up from the compliance controls Planner board.
Testing Done
Ran the policy against 4 unit test scenarios (compliant, non-compliant, no policies, result structure) using OPA test — all 4/4 passing. Live tenant scan verification is blocked pending M365 credentials for the test environment, so this has not yet been validated against a live tenant.
Security Considerations
No auth, secrets, or API permission changes. Policy only reads data already collected via the existing exchange.organization.owa_mailbox_policy collector (Exchange.Manage permission, already required).
Breaking Changes
Rollback Plan
Checklist
Screenshots
N/A — no frontend changes.