|
| 1 | +from collections import Counter |
| 2 | + |
| 3 | +from prowler.lib.check.models import Check, CheckReportM365 |
| 4 | +from prowler.providers.m365.services.entra.entra_client import entra_client |
| 5 | +from prowler.providers.m365.services.entra.entra_service import ( |
| 6 | + ConditionalAccessPolicyState, |
| 7 | +) |
| 8 | + |
| 9 | + |
| 10 | +class entra_emergency_access_exclusion(Check): |
| 11 | + """Check if at least one emergency access account or group is excluded from all Conditional Access policies. |
| 12 | +
|
| 13 | + This check ensures that the tenant has at least one emergency/break glass account |
| 14 | + or account exclusion group that is excluded from all Conditional Access policies. |
| 15 | + This prevents accidental lockout scenarios where misconfigured CA policies could |
| 16 | + block all administrative access to the tenant. |
| 17 | +
|
| 18 | + - PASS: At least one user or group is excluded from all enabled Conditional Access policies, |
| 19 | + or there are no enabled policies. |
| 20 | + - FAIL: No user or group is excluded from all enabled Conditional Access policies. |
| 21 | + """ |
| 22 | + |
| 23 | + def execute(self) -> list[CheckReportM365]: |
| 24 | + """Execute the check for emergency access account exclusions. |
| 25 | +
|
| 26 | + Returns: |
| 27 | + list[CheckReportM365]: A list containing the result of the check. |
| 28 | + """ |
| 29 | + findings = [] |
| 30 | + |
| 31 | + # Get all enabled CA policies (excluding disabled ones) |
| 32 | + enabled_policies = [ |
| 33 | + policy |
| 34 | + for policy in entra_client.conditional_access_policies.values() |
| 35 | + if policy.state != ConditionalAccessPolicyState.DISABLED |
| 36 | + ] |
| 37 | + |
| 38 | + # If there are no enabled policies, there's nothing to exclude from |
| 39 | + if not enabled_policies: |
| 40 | + report = CheckReportM365( |
| 41 | + metadata=self.metadata(), |
| 42 | + resource={}, |
| 43 | + resource_name="Conditional Access Policies", |
| 44 | + resource_id="conditionalAccessPolicies", |
| 45 | + ) |
| 46 | + report.status = "PASS" |
| 47 | + report.status_extended = "No enabled Conditional Access policies found. Emergency access exclusions are not required." |
| 48 | + findings.append(report) |
| 49 | + return findings |
| 50 | + |
| 51 | + total_policy_count = len(enabled_policies) |
| 52 | + |
| 53 | + # Count how many policies exclude each user |
| 54 | + excluded_users_counter = Counter() |
| 55 | + for policy in enabled_policies: |
| 56 | + user_conditions = policy.conditions.user_conditions |
| 57 | + if user_conditions: |
| 58 | + for user_id in user_conditions.excluded_users: |
| 59 | + excluded_users_counter[user_id] += 1 |
| 60 | + |
| 61 | + # Count how many policies exclude each group |
| 62 | + excluded_groups_counter = Counter() |
| 63 | + for policy in enabled_policies: |
| 64 | + user_conditions = policy.conditions.user_conditions |
| 65 | + if user_conditions: |
| 66 | + for group_id in user_conditions.excluded_groups: |
| 67 | + excluded_groups_counter[group_id] += 1 |
| 68 | + |
| 69 | + # Find users excluded from ALL policies |
| 70 | + users_excluded_from_all = [ |
| 71 | + user_id |
| 72 | + for user_id, count in excluded_users_counter.items() |
| 73 | + if count == total_policy_count |
| 74 | + ] |
| 75 | + |
| 76 | + # Find groups excluded from ALL policies |
| 77 | + groups_excluded_from_all = [ |
| 78 | + group_id |
| 79 | + for group_id, count in excluded_groups_counter.items() |
| 80 | + if count == total_policy_count |
| 81 | + ] |
| 82 | + |
| 83 | + has_emergency_exclusion = bool( |
| 84 | + users_excluded_from_all or groups_excluded_from_all |
| 85 | + ) |
| 86 | + |
| 87 | + for policy in enabled_policies: |
| 88 | + report = CheckReportM365( |
| 89 | + metadata=self.metadata(), |
| 90 | + resource=policy, |
| 91 | + resource_name=policy.display_name, |
| 92 | + resource_id=policy.id, |
| 93 | + ) |
| 94 | + |
| 95 | + if has_emergency_exclusion: |
| 96 | + report.status = "PASS" |
| 97 | + exclusion_details = [] |
| 98 | + if users_excluded_from_all: |
| 99 | + exclusion_details.append(f"{len(users_excluded_from_all)} user(s)") |
| 100 | + if groups_excluded_from_all: |
| 101 | + exclusion_details.append( |
| 102 | + f"{len(groups_excluded_from_all)} group(s)" |
| 103 | + ) |
| 104 | + report.status_extended = f"Conditional Access Policy '{policy.display_name}' has {' and '.join(exclusion_details)} excluded as emergency access across all {total_policy_count} enabled policies." |
| 105 | + else: |
| 106 | + report.status = "FAIL" |
| 107 | + report.status_extended = f"Conditional Access Policy '{policy.display_name}' does not have any user or group excluded as emergency access from all enabled Conditional Access policies." |
| 108 | + |
| 109 | + findings.append(report) |
| 110 | + |
| 111 | + return findings |
0 commit comments