feat(compliance): implement CIS 1.3.9 shared bookings restriction - #333
Open
yergaliev98 wants to merge 2 commits into
Open
feat(compliance): implement CIS 1.3.9 shared bookings restriction#333yergaliev98 wants to merge 2 commits into
yergaliev98 wants to merge 2 commits into
Conversation
Extend the OWA mailbox policy collector to retrieve the tenant-level BookingsEnabled setting via Get-OrganizationConfig instead of building a new collector, avoiding a duplicate Exchange Online call. Add the Rego policy evaluating compliance across both the default OWA policy and org-wide configuration paths, with unit tests covering compliant, non-compliant, both-disabled and missing-data scenarios. Moves 1.3.9 from not_started to ready.
Contributor
Preview EnvironmentA preview environment can be spun up on demand for this PR.
|
Contributor
CI: Engine
All checks passed. |
…ctor Capture the raw Get-OwaMailboxPolicy result as Any before normalizing, instead of letting mypy lock the policies variable to dict[str, Any] from run_cmdlet's declared return type on first assignment — mypy was then treating every 'for p in policies' as iterating dict keys (str) rather than list items, causing 9 false type errors. Also removes a duplicate default_policy_bookings_mailbox_creation_enabled key in the returned dict.
yergaliev98
added a commit
that referenced
this pull request
Aug 24, 2026
…oint support Explicitly annotate client as PowerShellClient | SharePointClient | GraphClient instead of letting mypy infer its type from whichever if/elif branch it processes first. Add scoped type: ignore[arg-type] on the two collector.collect() calls, since BaseDataCollector.collect()'s declared signature only accepts GraphClient and hasn't been generalised for PowerShell/SharePoint collectors — a pre-existing base-class limitation out of scope for this change. Note: this file imports collectors.registry, which registers every collector in the project. mypy follows that import and reports ~100 pre-existing type errors across registry.py and ~15 other Exchange collector files that share an identical, pre-existing None/dict/list normalisation bug (the same class of issue fixed for one instance of it, owa_mailbox_policy.py, in PR #333). None of those errors are introduced by this change - test_collector.py itself now type-checks clean aside from one pre-existing issue in get_credentials() (line 75, also predating this diff). Raising the wider debt with the team separately rather than fixing ~16 unrelated files here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Extends the existing OWA mailbox policy collector to also retrieve the tenant-level
BookingsEnabledsetting viaGet-OrganizationConfig, rather than building a brand-new collector — this avoids a duplicate Exchange Online authentication/collection call. Adds the Rego policy for CIS 1.3.9, which evaluates compliance across both the default OWA policy path (BookingsMailboxCreationEnabled) and the org-wide configuration path (BookingsEnabled), backed by unit tests covering compliant, non-compliant, both-disabled, and missing-data scenarios. Moves control 1.3.9 fromnot_startedtoreadyinmetadata.json.Type of Change
Affected Components
/backend-api/frontend/engine(collectors / policies)/security/infrastructure/.github/workflows/docsMotivation
Control 1.3.9 (Ensure Shared Bookings pages are restricted to select users) was
not_startedin the CIS Microsoft 365 Foundations Benchmark v6.0.0 mapping — no collector or policy existed. Implementing it was part of my individual contribution plan for this trimester (tracked on the team Planner board), alongside 5.1.4.4.Testing Done
opa test tests/test_1_3_9_bookings_restrictions.rego policies/— 6/6 tests pass, covering: OWA-policy-level bookings disabled (compliant), org-level bookings disabled (compliant), both disabled (compliant), both enabled (non-compliant), missing evidence (does not falsely report compliant), and result-details structure.BookingsMailboxCreationEnabledandBookingsEnabledare returned correctly; restarted the Compliance Engine and ran a full scan to confirm control 1.3.9 loads and evaluates correctly end-to-end in the AutoAudit dashboard.Security Considerations
No new secrets or credentials introduced. Uses the existing
Exchange.ManagePowerShell scope already declared inmetadata.jsonfor this collector — no new permission scope requested.Get-OrganizationConfigis a read-only call; no data is written back to the tenant.Breaking Changes
Field additions to
OwaMailboxPolicyDataCollector's output are additive only; no existing fields were renamed or removed, so nothing consuming the old collector output is affected.Rollback Plan
No DB migrations involved; reverting the commit restores control 1.3.9 to
not_started.Checklist
Screenshots
N/A — backend/policy-engine change only, no UI changes. See dashboard verification screenshots in my 5.1P/10.1P evidence report if a visual is wanted.