Ensure service principals ability to create workspaces, connections and deployment pipelines is restricted

보통레벨 1수동 검토m365

설명

Use a service principal to access these Fabric APIs that aren't protected by a Fabric permission model. - Create Workspace - Create Connection - Create Deployment Pipeline To allow an app to use service principal authentication, its service principal must be included in an allowed security group. You can control who can access service principals by creating dedicated security groups and using these groups in other tenant settings. The recommended state is Enabled for a subset of the organization or Disabled. Leaving API access unrestricted increases the attack surface in the event an adversary gains access to a Service Principal. APIs are a feature-rich method for programmatic access to many areas of Power Bi and should be guarded closely.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

CIS Benchmark Recommendation Set Correctly Yes No 6.1.1 Ensure 'AuditDisabled' organizationally is set to 'False' (Automated)   6.1.2 Ensure mailbox audit actions are configured (Automated)   6.1.3 Ensure 'AuditBypassEnabled' is not enabled on mailboxes (Automated)   6.2 Mail flow 6.2.1 Ensure all forms of mail forwarding are blocked and/or disabled (Automated)   6.2.2 Ensure mail transport rules do not whitelist specific domains (Automated)   6.2.3 Ensure email from external senders is identified (Automated)   6.3 Roles 6.3.1 Ensure users installing Outlook add-ins is not allowed (Automated)   6.3.2 Ensure the ability to add personal email accounts and calendars is disabled (Automated)   6.4 Reports 6.5 Settings 6.5.1 Ensure modern authentication for Exchange Online is enabled (Automated)   6.5.2 Ensure MailTips are enabled for end users (Automated)   6.5.3 Ensure additional storage providers are restricted in Outlook on the web (Automated)   6.5.4 Ensure SMTP AUTH is disabled (Automated)   CIS Benchmark Recommendation Set Correctly Yes No 6.5.5 Ensure Direct Send submissions are rejected (Automated)   7 SharePoint admin center 7.1 Sites 7.2 Policies 7...

조치 방법

조치 방식: 가이드 또는 인프라 패치

To remediate using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Developer settings. 4. Set Service principals can create workspaces, connections, and deployment pipelines to one of the following: o Disabled o Enabled with Specific security groups selected and defined. Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled.

속성

운영 체제: 모두
태그: ci-cdm365saas
참고 자료: CIS Microsoft 365 Foundations Benchmark v7.0.0 - 9.1.12 Ensure service principals ability to create workspaces, connections and deployment pipelines is restricted