Ensure service principals ability to create workspaces, connections and deployment pipelines is restricted

Trung bìnhCấp 1Xem xét thủ côngm365

Mô tả

Use a service principal to access these Fabric APIs that aren't protected by a Fabric permission model. - Create Workspace - Create Connection - Create Deployment Pipeline To allow an app to use service principal authentication, its service principal must be included in an allowed security group. You can control who can access service principals by creating dedicated security groups and using these groups in other tenant settings. The recommended state is Enabled for a subset of the organization or Disabled. Leaving API access unrestricted increases the attack surface in the event an adversary gains access to a Service Principal. APIs are a feature-rich method for programmatic access to many areas of Power Bi and should be guarded closely.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

CIS Benchmark Recommendation Set Correctly Yes No 6.1.1 Ensure 'AuditDisabled' organizationally is set to 'False' (Automated)   6.1.2 Ensure mailbox audit actions are configured (Automated)   6.1.3 Ensure 'AuditBypassEnabled' is not enabled on mailboxes (Automated)   6.2 Mail flow 6.2.1 Ensure all forms of mail forwarding are blocked and/or disabled (Automated)   6.2.2 Ensure mail transport rules do not whitelist specific domains (Automated)   6.2.3 Ensure email from external senders is identified (Automated)   6.3 Roles 6.3.1 Ensure users installing Outlook add-ins is not allowed (Automated)   6.3.2 Ensure the ability to add personal email accounts and calendars is disabled (Automated)   6.4 Reports 6.5 Settings 6.5.1 Ensure modern authentication for Exchange Online is enabled (Automated)   6.5.2 Ensure MailTips are enabled for end users (Automated)   6.5.3 Ensure additional storage providers are restricted in Outlook on the web (Automated)   6.5.4 Ensure SMTP AUTH is disabled (Automated)   CIS Benchmark Recommendation Set Correctly Yes No 6.5.5 Ensure Direct Send submissions are rejected (Automated)   7 SharePoint admin center 7.1 Sites 7.2 Policies 7...

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

To remediate using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Developer settings. 4. Set Service principals can create workspaces, connections, and deployment pipelines to one of the following: o Disabled o Enabled with Specific security groups selected and defined. Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: ci-cdm365saas
Tham chiếu: CIS Microsoft 365 Foundations Benchmark v7.0.0 - 9.1.12 Ensure service principals ability to create workspaces, connections and deployment pipelines is restricted