Ensure service principals ability to create workspaces, connections and deployment pipelines is restricted

OrtaDüzey 1Manuel incelemem365

Açıklama

Use a service principal to access these Fabric APIs that aren't protected by a Fabric permission model. - Create Workspace - Create Connection - Create Deployment Pipeline To allow an app to use service principal authentication, its service principal must be included in an allowed security group. You can control who can access service principals by creating dedicated security groups and using these groups in other tenant settings. The recommended state is Enabled for a subset of the organization or Disabled. Leaving API access unrestricted increases the attack surface in the event an adversary gains access to a Service Principal. APIs are a feature-rich method for programmatic access to many areas of Power Bi and should be guarded closely.

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

CIS Benchmark Recommendation Set Correctly Yes No 6.1.1 Ensure 'AuditDisabled' organizationally is set to 'False' (Automated)   6.1.2 Ensure mailbox audit actions are configured (Automated)   6.1.3 Ensure 'AuditBypassEnabled' is not enabled on mailboxes (Automated)   6.2 Mail flow 6.2.1 Ensure all forms of mail forwarding are blocked and/or disabled (Automated)   6.2.2 Ensure mail transport rules do not whitelist specific domains (Automated)   6.2.3 Ensure email from external senders is identified (Automated)   6.3 Roles 6.3.1 Ensure users installing Outlook add-ins is not allowed (Automated)   6.3.2 Ensure the ability to add personal email accounts and calendars is disabled (Automated)   6.4 Reports 6.5 Settings 6.5.1 Ensure modern authentication for Exchange Online is enabled (Automated)   6.5.2 Ensure MailTips are enabled for end users (Automated)   6.5.3 Ensure additional storage providers are restricted in Outlook on the web (Automated)   6.5.4 Ensure SMTP AUTH is disabled (Automated)   CIS Benchmark Recommendation Set Correctly Yes No 6.5.5 Ensure Direct Send submissions are rejected (Automated)   7 SharePoint admin center 7.1 Sites 7.2 Policies 7...

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

To remediate using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Developer settings. 4. Set Service principals can create workspaces, connections, and deployment pipelines to one of the following: o Disabled o Enabled with Specific security groups selected and defined. Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: ci-cdm365saas
Referans: CIS Microsoft 365 Foundations Benchmark v7.0.0 - 9.1.12 Ensure service principals ability to create workspaces, connections and deployment pipelines is restricted