Ensure service principals ability to create workspaces, connections and deployment pipelines is restricted

SedangLevel 1Tinjauan manualm365

Deskripsi

Use a service principal to access these Fabric APIs that aren't protected by a Fabric permission model. - Create Workspace - Create Connection - Create Deployment Pipeline To allow an app to use service principal authentication, its service principal must be included in an allowed security group. You can control who can access service principals by creating dedicated security groups and using these groups in other tenant settings. The recommended state is Enabled for a subset of the organization or Disabled. Leaving API access unrestricted increases the attack surface in the event an adversary gains access to a Service Principal. APIs are a feature-rich method for programmatic access to many areas of Power Bi and should be guarded closely.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

CIS Benchmark Recommendation Set Correctly Yes No 6.1.1 Ensure 'AuditDisabled' organizationally is set to 'False' (Automated)   6.1.2 Ensure mailbox audit actions are configured (Automated)   6.1.3 Ensure 'AuditBypassEnabled' is not enabled on mailboxes (Automated)   6.2 Mail flow 6.2.1 Ensure all forms of mail forwarding are blocked and/or disabled (Automated)   6.2.2 Ensure mail transport rules do not whitelist specific domains (Automated)   6.2.3 Ensure email from external senders is identified (Automated)   6.3 Roles 6.3.1 Ensure users installing Outlook add-ins is not allowed (Automated)   6.3.2 Ensure the ability to add personal email accounts and calendars is disabled (Automated)   6.4 Reports 6.5 Settings 6.5.1 Ensure modern authentication for Exchange Online is enabled (Automated)   6.5.2 Ensure MailTips are enabled for end users (Automated)   6.5.3 Ensure additional storage providers are restricted in Outlook on the web (Automated)   6.5.4 Ensure SMTP AUTH is disabled (Automated)   CIS Benchmark Recommendation Set Correctly Yes No 6.5.5 Ensure Direct Send submissions are rejected (Automated)   7 SharePoint admin center 7.1 Sites 7.2 Policies 7...

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

To remediate using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Developer settings. 4. Set Service principals can create workspaces, connections, and deployment pipelines to one of the following: o Disabled o Enabled with Specific security groups selected and defined. Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled.

Properti

Sistem operasi: Apa saja
Tag: ci-cdm365saas
Referensi: CIS Microsoft 365 Foundations Benchmark v7.0.0 - 9.1.12 Ensure service principals ability to create workspaces, connections and deployment pipelines is restricted