fix: update of 5.1.4.4 control - #335
Open
yergaliev98 wants to merge 1 commit into
Open
Conversation
Contributor
Preview EnvironmentA preview environment can be spun up on demand for this PR.
|
Contributor
CI: Engine
One or more checks failed. View logs |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Extends the existing
device_registration_policy.pycollector to pull the additional Microsoft Graph fields needed to evaluate CIS control 5.1.4.4 (local administrator assignment during Entra join) — specifically theazureADJoin.localAdminssettings from thebeta/policies/deviceRegistrationPolicyendpoint. Adds the Rego policy evaluating whether local administrator assignment during Entra join is limited to an approved group, none, or unrestricted, backed by unit tests covering compliant, non-compliant, empty, and missing-data scenarios. Moves control 5.1.4.4 fromnot_startedtoreadyinmetadata.json.Type of Change
Affected Components
/backend-api/frontend/engine(collectors / policies)/security/infrastructure/.github/workflows/docsMotivation
Control 5.1.4.4 (Ensure local administrator assignment is limited during Entra join) was
not_startedin the CIS Microsoft 365 Foundations Benchmark v6.0.0 mapping — the metadata showed a collector already existed but no Rego policy had been written. Implementing it was part of my individual contribution plan for this trimester (tracked on the team Planner board), alongside 1.3.9.Testing Done
opa test tests/test_cis_5_1_4_4_local_admin_assignment.rego policies/— 5/5 tests pass, covering: compliant (selected users/groups configured), compliant (no registering users added as local administrators), non-compliant (unrestricted assignment), missing/empty configuration data, and result-details structure.local_admin_settingsandregistering_usersfields after normalisation; restarted the Compliance Engine and ran a full scan to confirm control 5.1.4.4 loads and evaluates correctly end-to-end in the AutoAudit dashboard.Security Considerations
No new secrets or credentials introduced. Uses the
Policy.Read.AllMicrosoft Graph permission already declared inmetadata.jsonfor this collector — no new permission scope requested. ThedeviceRegistrationPolicyendpoint call is read-only; no data is written back to the tenant.Breaking Changes
Field additions to the device registration policy collector's output are additive only; no existing fields were renamed or removed, so nothing consuming the old collector output is affected. The
registry.pychange only registers this control's policy mapping and doesn't alter existing entries.Rollback Plan
No DB migrations involved; reverting the commit restores control 5.1.4.4 to
not_started.Checklist
Screenshots
N/A — backend/policy-engine change only, no UI changes. See dashboard verification screenshots (control 5.1.4.4 evaluated correctly) in my 5.1P/10.1P evidence report if a visual is wanted.