feat(cis): automate control 5.1.4.2 device limit - #328
Conversation
Preview EnvironmentA preview environment can be spun up on demand for this PR.
|
CI: Engine
All checks passed. |
There was a problem hiding this comment.
Pull request overview
Automates CIS Microsoft 365 Foundations v6.0.0 control 5.1.4.2 by wiring it to the Entra device registration policy collector and adding a Rego policy (plus tests) to evaluate whether the per-user device registration quota stays within the CIS-recommended limit.
Changes:
- Mark control 5.1.4.2 as automated/ready in benchmark metadata and point it at
entra.devices.device_registration_policy. - Add a new Rego policy implementing compliance logic for the max-devices-per-user quota.
- Add Rego tests covering compliant/non-compliant and missing/null quota scenarios.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| engine/tests/test_cis_5_1_4_2_max_devices_per_user.rego | Adds OPA/Rego test cases for the new control logic. |
| engine/policies/cis/microsoft-365-foundations/v6.0.0/metadata.json | Wires control 5.1.4.2 to the correct collector, policy file, and permission scope. |
| engine/policies/cis/microsoft-365-foundations/v6.0.0/5.1.4.2_max_devices_per_user.rego | Implements the automated compliance evaluation and result payload for control 5.1.4.2. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| # requires_permissions: | ||
| # - Policy.Read.All |
| test_non_compliant_missing_quota if { | ||
| result := data.cis.microsoft_365_foundations.v6_0_0.control_5_1_4_2.result with input as {} | ||
|
|
||
| result.compliant == false | ||
| result.message == "Unable to determine maximum devices per user" | ||
| } |
|
|
||
| compliant if { | ||
| input.user_device_quota != null | ||
| is_number(input.user_device_quota) | ||
| input.user_device_quota <= 20 | ||
| } | ||
|
|
||
| result := { | ||
| "compliant": compliant, | ||
| "message": message, | ||
| "details": { | ||
| "user_device_quota": object.get(input, "user_device_quota", null), | ||
| "recommended_maximum": 20, | ||
| }, | ||
| } | ||
|
|
||
| message := "Maximum devices per user is within the CIS recommended limit" if { | ||
| compliant | ||
| } | ||
|
|
||
| message := "Maximum devices per user exceeds the CIS recommended limit" if { | ||
| input.user_device_quota != null | ||
| is_number(input.user_device_quota) | ||
| input.user_device_quota > 20 | ||
| } |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ba9d11bfb7
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| # severity: medium | ||
| # service: EntraID | ||
| # requires_permissions: | ||
| # - Policy.Read.All |
There was a problem hiding this comment.
When policy annotations are inspected or copied—a supported workflow in engine/policies/README.md—this advertises Policy.Read.All, but the selected collector calls /beta/policies/deviceRegistrationPolicy, and both its module documentation and this control's metadata.json require Policy.Read.DeviceConfiguration. A tool provisioning scopes from the embedded annotation can therefore grant the wrong permission and make this newly ready control fail during collection; keep the annotation synchronized with the collector and benchmark metadata.
Useful? React with 👍 / 👎.
Summary
Type of Change
Affected Components
/backend-api/frontend/engine(collectors / policies)/security/infrastructure/.github/workflows/docsMotivation
Testing Done
Security Considerations
Breaking Changes
Rollback Plan
Checklist
Screenshots