ben.carrasco/prowler
1
0 Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-10-30 15:24:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(microsoft365): add new check entra_policy_ensure_default_user_cannot_create_tenants (#6918)

Browse Source 
Co-authored-by: MrCloudSec <hello@mistercloudsec.com>
This commit is contained in:
Hugo Pereira BritoandMrCloudSec authored and GitHub committed 2025-02-27 10:31:02 +01:00
1 parent 1180522725
commit 0f414e451e
5 files changed
+259 -18
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

tests/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/microsoft365_entra_policy_ensure_default_user_cannot_create_tenants_test.py
+149
View File
@@ -0,0 +1,149 @@
from unittest import mock
from uuid import uuid4
from prowler.providers.microsoft365.services.entra.entra_service import (
AuthorizationPolicy,
DefaultUserRolePermissions,
)
from tests.providers.microsoft365.microsoft365_fixtures import (
set_mocked_microsoft365_provider,
)
class Test_entra_policy_ensure_default_user_cannot_create_tenants:
def test_entra_empty_tenant(self):
entra_client = mock.MagicMock
entra_client.authorization_policy = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_microsoft365_provider(),
),
mock.patch(
"prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client",
new=entra_client,
),
):
from prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import (
entra_policy_ensure_default_user_cannot_create_tenants,
)
check = entra_policy_ensure_default_user_cannot_create_tenants()
result = check.execute()
assert len(result) == 1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== "Tenant creation is not disabled for non-admin users."
)
assert result[0].resource == {}
assert result[0].resource_name == "Authorization Policy"
assert result[0].resource_id == "authorizationPolicy"
assert result[0].location == "global"
def test_entra_default_user_role_permissions_allowed_to_create_tenants(self):
id = str(uuid4())
entra_client = mock.MagicMock
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_microsoft365_provider(),
),
mock.patch(
"prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client",
new=entra_client,
),
):
from prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import (
entra_policy_ensure_default_user_cannot_create_tenants,
)
entra_client.authorization_policy = AuthorizationPolicy(
id=id,
name="Test",
description="Test",
default_user_role_permissions=DefaultUserRolePermissions(
allowed_to_create_tenants=True
),
)
check = entra_policy_ensure_default_user_cannot_create_tenants()
result = check.execute()
assert len(result) == 1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== "Tenant creation is not disabled for non-admin users."
)
assert result[0].resource == {
"id": id,
"name": "Test",
"description": "Test",
"default_user_role_permissions": {
"allowed_to_create_apps": None,
"allowed_to_create_security_groups": None,
"allowed_to_create_tenants": True,
"allowed_to_read_bitlocker_keys_for_owned_device": None,
"allowed_to_read_other_users": None,
"odata_type": None,
"permission_grant_policies_assigned": None,
},
}
assert result[0].resource_name == "Test"
assert result[0].resource_id == id
assert result[0].location == "global"
def test_entra_default_user_role_permissions_not_allowed_to_create_tenants(self):
id = str(uuid4())
entra_client = mock.MagicMock
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_microsoft365_provider(),
),
mock.patch(
"prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client",
new=entra_client,
),
):
from prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import (
entra_policy_ensure_default_user_cannot_create_tenants,
)
entra_client.authorization_policy = AuthorizationPolicy(
id=id,
name="Test",
description="Test",
default_user_role_permissions=DefaultUserRolePermissions(
allowed_to_create_tenants=False
),
)
check = entra_policy_ensure_default_user_cannot_create_tenants()
result = check.execute()
assert len(result) == 1
assert result[0].status == "PASS"
assert (
result[0].status_extended
== "Tenant creation is disabled for non-admin users."
)
assert result[0].resource == {
"id": id,
"name": "Test",
"description": "Test",
"default_user_role_permissions": {
"allowed_to_create_apps": None,
"allowed_to_create_security_groups": None,
"allowed_to_create_tenants": False,
"allowed_to_read_bitlocker_keys_for_owned_device": None,
"allowed_to_read_other_users": None,
"odata_type": None,
"permission_grant_policies_assigned": None,
},
}
assert result[0].resource_name == "Test"
assert result[0].resource_id == id
assert result[0].location == "global"
tests/providers/microsoft365/services/entra/microsoft365_entra_service_test.py
+30 -18
View File
@@ -3,6 +3,7 @@ from unittest.mock import patch
from prowler.providers.microsoft365.models import Microsoft365IdentityInfo
from prowler.providers.microsoft365.services.entra.entra_service import (
AuthorizationPolicy,
DefaultUserRolePermissions,
Entra,
)
from tests.providers.microsoft365.microsoft365_fixtures import (
@@ -12,20 +13,20 @@ from tests.providers.microsoft365.microsoft365_fixtures import (
async def mock_entra_get_authorization_policy(_):
return {
"id-1": AuthorizationPolicy(
id="id-1",
name="Name 1",
description="Description 1",
default_user_role_permissions=None,
)
}
return AuthorizationPolicy(
id="id-1",
name="Name 1",
description="Description 1",
default_user_role_permissions=DefaultUserRolePermissions(
allowed_to_create_apps=True,
allowed_to_create_security_groups=True,
allowed_to_create_tenants=True,
allowed_to_read_bitlocker_keys_for_owned_device=True,
allowed_to_read_other_users=True,
),
)
@patch(
"prowler.providers.microsoft365.services.entra.entra_service.Entra._get_authorization_policy",
new=mock_entra_get_authorization_policy,
)
class Test_Entra_Service:
def test_get_client(self):
admincenter_client = Entra(
@@ -35,11 +36,22 @@ class Test_Entra_Service:
)
assert admincenter_client.client.__class__.__name__ == "GraphServiceClient"
@patch(
"prowler.providers.microsoft365.services.entra.entra_service.Entra._get_authorization_policy",
new=mock_entra_get_authorization_policy,
)
def test_get_authorization_policy(self):
entra_client = Entra(set_mocked_microsoft365_provider())
assert entra_client.authorization_policy["id-1"].id == "id-1"
assert entra_client.authorization_policy["id-1"].name == "Name 1"
assert entra_client.authorization_policy["id-1"].description == "Description 1"
assert not entra_client.authorization_policy[
"id-1"
].default_user_role_permissions
assert entra_client.authorization_policy.id == "id-1"
assert entra_client.authorization_policy.name == "Name 1"
assert entra_client.authorization_policy.description == "Description 1"
assert (
entra_client.authorization_policy.default_user_role_permissions
== DefaultUserRolePermissions(
allowed_to_create_apps=True,
allowed_to_create_security_groups=True,
allowed_to_create_tenants=True,
allowed_to_read_bitlocker_keys_for_owned_device=True,
allowed_to_read_other_users=True,
)
)