Ensure 'Administrative accounts are separate, unassigned, and cloud-only'

中レベル 1手動レビューpower-platform

説明

Administrative accounts are special privileged accounts that could have varying levels of access to data, users, and settings. Each system administrator should utilize two (2) separate accounts, an administrator account to perform administrative tasks and a separate account for daily activities such as checking email. Users should only sign in with system administrator account to perform administrative tasks in the environment. Users with the system administrator role automatically have access to records, system, and custom entities. Creating separate administrative accounts can reduce the risk of credential theft and other types of attacks.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Verify there are separate administrative accounts being utilized. In the Microsoft 365 Admin Center: 1. Log in to https://admin.microsoft.com as a Global Administrator. 2. Select Users > Active users then sort by the User type column. 3. Verify that Administrators have a dedicated administrative and regular user account.

修正方法

修正方法: ガイダンスまたは IaC パッチ

Ensure each administrator has an administrative and regular user account. In the Microsoft 365 Admin Center: 1. Log in to https://admin.microsoft.com as a Global Administrator. 2. Go to Users and then Active users and select Add a user. 3. Fill out the appropriate fields for Name, user, domain, password etc. 4. When prompted to assign licenses select Create user without product license (not recommended), then click Next. 5. Under the Option settings choose Admin center access followed by the appropriate role then click Next. 6. Select Finish adding. Note: Take into account the proper and valid licensing requirements and attribute the security roles inside power platform with the least privilege approach.

プロパティ

オペレーティングシステム: すべて
タグ: power-platformsaas
参照: CIS Microsoft Dynamics 365 Power Platform Benchmark v1.0.1 - 1.3 Ensure 'Administrative accounts are separate, unassigned, and cloud-only'