Ensure 'Administrative accounts are separate, unassigned, and cloud-only'

보통레벨 1수동 검토power-platform

설명

Administrative accounts are special privileged accounts that could have varying levels of access to data, users, and settings. Each system administrator should utilize two (2) separate accounts, an administrator account to perform administrative tasks and a separate account for daily activities such as checking email. Users should only sign in with system administrator account to perform administrative tasks in the environment. Users with the system administrator role automatically have access to records, system, and custom entities. Creating separate administrative accounts can reduce the risk of credential theft and other types of attacks.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Verify there are separate administrative accounts being utilized. In the Microsoft 365 Admin Center: 1. Log in to https://admin.microsoft.com as a Global Administrator. 2. Select Users > Active users then sort by the User type column. 3. Verify that Administrators have a dedicated administrative and regular user account.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Ensure each administrator has an administrative and regular user account. In the Microsoft 365 Admin Center: 1. Log in to https://admin.microsoft.com as a Global Administrator. 2. Go to Users and then Active users and select Add a user. 3. Fill out the appropriate fields for Name, user, domain, password etc. 4. When prompted to assign licenses select Create user without product license (not recommended), then click Next. 5. Under the Option settings choose Admin center access followed by the appropriate role then click Next. 6. Select Finish adding. Note: Take into account the proper and valid licensing requirements and attribute the security roles inside power platform with the least privilege approach.

속성

운영 체제: 모두
태그: power-platformsaas
참고 자료: CIS Microsoft Dynamics 365 Power Platform Benchmark v1.0.1 - 1.3 Ensure 'Administrative accounts are separate, unassigned, and cloud-only'