Ensure service principals ability to create workspaces, connections and deployment pipelines is restricted

MediaNivel 1Revisión manualm365

Descripción

Use a service principal to access these Fabric APIs that aren't protected by a Fabric permission model. - Create Workspace - Create Connection - Create Deployment Pipeline To allow an app to use service principal authentication, its service principal must be included in an allowed security group. You can control who can access service principals by creating dedicated security groups and using these groups in other tenant settings. The recommended state is Enabled for a subset of the organization or Disabled. Leaving API access unrestricted increases the attack surface in the event an adversary gains access to a Service Principal. APIs are a feature-rich method for programmatic access to many areas of Power Bi and should be guarded closely.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

CIS Benchmark Recommendation Set Correctly Yes No 6.1.1 Ensure 'AuditDisabled' organizationally is set to 'False' (Automated)   6.1.2 Ensure mailbox audit actions are configured (Automated)   6.1.3 Ensure 'AuditBypassEnabled' is not enabled on mailboxes (Automated)   6.2 Mail flow 6.2.1 Ensure all forms of mail forwarding are blocked and/or disabled (Automated)   6.2.2 Ensure mail transport rules do not whitelist specific domains (Automated)   6.2.3 Ensure email from external senders is identified (Automated)   6.3 Roles 6.3.1 Ensure users installing Outlook add-ins is not allowed (Automated)   6.3.2 Ensure the ability to add personal email accounts and calendars is disabled (Automated)   6.4 Reports 6.5 Settings 6.5.1 Ensure modern authentication for Exchange Online is enabled (Automated)   6.5.2 Ensure MailTips are enabled for end users (Automated)   6.5.3 Ensure additional storage providers are restricted in Outlook on the web (Automated)   6.5.4 Ensure SMTP AUTH is disabled (Automated)   CIS Benchmark Recommendation Set Correctly Yes No 6.5.5 Ensure Direct Send submissions are rejected (Automated)   7 SharePoint admin center 7.1 Sites 7.2 Policies 7...

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

To remediate using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Developer settings. 4. Set Service principals can create workspaces, connections, and deployment pipelines to one of the following: o Disabled o Enabled with Specific security groups selected and defined. Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: ci-cdm365saas
Referencia: CIS Microsoft 365 Foundations Benchmark v7.0.0 - 9.1.12 Ensure service principals ability to create workspaces, connections and deployment pipelines is restricted