|
| 1 | +from collections import Counter |
| 2 | + |
| 3 | +from prowler.lib.check.models import Check, CheckReportM365 |
| 4 | +from prowler.providers.m365.services.entra.entra_client import entra_client |
| 5 | +from prowler.providers.m365.services.entra.entra_service import ( |
| 6 | + ConditionalAccessPolicyState, |
| 7 | +) |
| 8 | + |
| 9 | + |
| 10 | +class entra_break_glass_account_fido2_security_key_registered(Check): |
| 11 | + """Ensure that break glass accounts have FIDO2 security keys registered. |
| 12 | +
|
| 13 | + This check identifies break glass (emergency access) accounts by finding users |
| 14 | + excluded from all enabled Conditional Access policies, then verifies each has |
| 15 | + at least one FIDO2 security key registered as an authentication method. |
| 16 | +
|
| 17 | + - PASS: The break glass account has a FIDO2 security key (fido2SecurityKey) registered. |
| 18 | + - MANUAL: The account has a device-bound passkey but it cannot be confirmed as FIDO2, |
| 19 | + or no break glass accounts could be identified. |
| 20 | + - FAIL: The break glass account does not have a FIDO2 security key registered. |
| 21 | + """ |
| 22 | + |
| 23 | + def execute(self) -> list[CheckReportM365]: |
| 24 | + """Execute the check for FIDO2 registration on break glass accounts. |
| 25 | +
|
| 26 | + Returns: |
| 27 | + A list of reports containing the result of the check. |
| 28 | + """ |
| 29 | + findings = [] |
| 30 | + |
| 31 | + enabled_policies = [ |
| 32 | + policy |
| 33 | + for policy in entra_client.conditional_access_policies.values() |
| 34 | + if policy.state != ConditionalAccessPolicyState.DISABLED |
| 35 | + ] |
| 36 | + |
| 37 | + if not enabled_policies: |
| 38 | + report = CheckReportM365( |
| 39 | + metadata=self.metadata(), |
| 40 | + resource={}, |
| 41 | + resource_name="Break Glass Accounts", |
| 42 | + resource_id="breakGlassAccounts", |
| 43 | + ) |
| 44 | + report.status = "MANUAL" |
| 45 | + report.status_extended = "No enabled Conditional Access policies found. Break glass accounts cannot be identified to verify FIDO2 registration." |
| 46 | + findings.append(report) |
| 47 | + return findings |
| 48 | + |
| 49 | + total_policy_count = len(enabled_policies) |
| 50 | + |
| 51 | + excluded_users_counter = Counter() |
| 52 | + for policy in enabled_policies: |
| 53 | + user_conditions = policy.conditions.user_conditions |
| 54 | + if user_conditions: |
| 55 | + for user_id in user_conditions.excluded_users: |
| 56 | + excluded_users_counter[user_id] += 1 |
| 57 | + |
| 58 | + break_glass_user_ids = [ |
| 59 | + user_id |
| 60 | + for user_id, count in excluded_users_counter.items() |
| 61 | + if count == total_policy_count |
| 62 | + ] |
| 63 | + |
| 64 | + if not break_glass_user_ids: |
| 65 | + report = CheckReportM365( |
| 66 | + metadata=self.metadata(), |
| 67 | + resource={}, |
| 68 | + resource_name="Break Glass Accounts", |
| 69 | + resource_id="breakGlassAccounts", |
| 70 | + ) |
| 71 | + report.status = "MANUAL" |
| 72 | + report.status_extended = "No break glass accounts identified. No users are excluded from all enabled Conditional Access policies." |
| 73 | + findings.append(report) |
| 74 | + return findings |
| 75 | + |
| 76 | + for user_id in break_glass_user_ids: |
| 77 | + user = entra_client.users.get(user_id) |
| 78 | + if not user: |
| 79 | + continue |
| 80 | + |
| 81 | + report = CheckReportM365( |
| 82 | + metadata=self.metadata(), |
| 83 | + resource=user, |
| 84 | + resource_name=user.name, |
| 85 | + resource_id=user.id, |
| 86 | + ) |
| 87 | + |
| 88 | + auth_methods = set(user.authentication_methods) |
| 89 | + has_fido2 = "fido2SecurityKey" in auth_methods |
| 90 | + has_passkey_device_bound = "passKeyDeviceBound" in auth_methods |
| 91 | + |
| 92 | + if has_fido2: |
| 93 | + report.status = "PASS" |
| 94 | + report.status_extended = f"Break glass account {user.name} has a FIDO2 security key registered." |
| 95 | + elif has_passkey_device_bound: |
| 96 | + report.status = "MANUAL" |
| 97 | + report.status_extended = f"Break glass account {user.name} has a device-bound passkey registered, but it cannot be confirmed whether it is a FIDO2 security key." |
| 98 | + else: |
| 99 | + report.status = "FAIL" |
| 100 | + report.status_extended = f"Break glass account {user.name} does not have a FIDO2 security key registered." |
| 101 | + |
| 102 | + findings.append(report) |
| 103 | + |
| 104 | + return findings |
0 commit comments