Implement CIS 1.2.2 shared mailbox sign-in control - #323
Conversation
Preview EnvironmentA preview environment can be spun up on demand for this PR.
|
CI: Engine
All checks passed. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c264ada33e
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| user_account = await client.run_cmdlet( | ||
| "ExchangeOnline", | ||
| "Get-User", | ||
| Identity=user_principal_name, | ||
| ) |
There was a problem hiding this comment.
For tenants where Exchange recipient state and the Entra user sign-in flag differ, this Get-User lookup can report the mailbox as blocked based on Exchange AccountDisabled even though the actual Microsoft 365 account can still sign in. The repository's CIS source for 1.2.2 audits Get-MgUser with AccountEnabled and expects that value to be False (docs/engine/Framework/CIS_M365_Benchmarks.json:82), so the collector should query Graph by ExternalDirectoryObjectId (or otherwise return authoritative Entra accountEnabled) before marking the control ready.
Useful? React with 👍 / 👎.
1 participant
Summary
Implements CIS 1.2.2 by updating the shared mailbox collector, adding the Rego policy and test, and updating the control metadata.
Type of Change
Affected Components
/backend-api/frontend/engine(collectors / policies)/security/infrastructure/.github/workflows/docsMotivation
This control is required to automate CIS 1.2.2 and verify that shared mailbox sign-in is blocked as expected.
Testing Done
Security Considerations
Breaking Changes
Rollback Plan
Checklist
Screenshots