From 808e8297b053bdc91fc657385e9fc558276502a2 Mon Sep 17 00:00:00 2001 From: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com> Date: Wed, 23 Apr 2025 16:31:17 +0200 Subject: [PATCH] feat(teams): add new check `teams_meeting_anonymous_user_start_disabled` (#7567) --- prowler/CHANGELOG.md | 1 + .../__init__.py | 0 ...nonymous_user_start_disabled.metadata.json | 30 +++++ ...s_meeting_anonymous_user_start_disabled.py | 40 ++++++ .../m365/services/teams/teams_service.py | 6 +- ...ting_anonymous_user_start_disabled_test.py | 117 ++++++++++++++++++ .../m365/services/teams/teams_service_test.py | 8 +- 7 files changed, 199 insertions(+), 3 deletions(-) create mode 100644 prowler/providers/m365/services/teams/teams_meeting_anonymous_user_start_disabled/__init__.py create mode 100644 prowler/providers/m365/services/teams/teams_meeting_anonymous_user_start_disabled/teams_meeting_anonymous_user_start_disabled.metadata.json create mode 100644 prowler/providers/m365/services/teams/teams_meeting_anonymous_user_start_disabled/teams_meeting_anonymous_user_start_disabled.py create mode 100644 tests/providers/m365/services/teams/teams_meeting_anonymous_user_start_disabled/teams_meeting_anonymous_user_start_disabled_test.py diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 6c8ffb5b0d..a938b5cf3e 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -24,6 +24,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Add new check for AllowList not used in the Connection Filter Policy from service Defender in M365 [(#7492)](https://github.com/prowler-cloud/prowler/pull/7492) - Add new check for SafeList not enabled in the Connection Filter Policy from service Defender in M365 [(#7492)](https://github.com/prowler-cloud/prowler/pull/7492) - Add new check for DKIM enabled for service Defender in M365 [(#7485)](https://github.com/prowler-cloud/prowler/pull/7485) +- Add new check `teams_meeting_anonymous_user_start_disabled` [(#7567)](https://github.com/prowler-cloud/prowler/pull/7567) ### Fixed diff --git a/prowler/providers/m365/services/teams/teams_meeting_anonymous_user_start_disabled/__init__.py b/prowler/providers/m365/services/teams/teams_meeting_anonymous_user_start_disabled/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/m365/services/teams/teams_meeting_anonymous_user_start_disabled/teams_meeting_anonymous_user_start_disabled.metadata.json b/prowler/providers/m365/services/teams/teams_meeting_anonymous_user_start_disabled/teams_meeting_anonymous_user_start_disabled.metadata.json new file mode 100644 index 0000000000..b8de5d3fb0 --- /dev/null +++ b/prowler/providers/m365/services/teams/teams_meeting_anonymous_user_start_disabled/teams_meeting_anonymous_user_start_disabled.metadata.json @@ -0,0 +1,30 @@ +{ + "Provider": "m365", + "CheckID": "teams_meeting_anonymous_user_start_disabled", + "CheckTitle": "Ensure anonymous users are not able to start meetings.", + "CheckType": [], + "ServiceName": "teams", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "critical", + "ResourceType": "Teams Global Meeting Policy", + "Description": "Ensure anonymous users and dial-in callers are not able to start meetings.", + "Risk": "Allowing anonymous users and dial-in callers to start meetings without an authenticated participant present can lead to meeting spamming, unauthorized activity, and potential misuse of organizational resources.", + "RelatedUrl": "https://learn.microsoft.com/en-us/powershell/module/teams/set-csteamsmeetingpolicy?view=teams-ps", + "Remediation": { + "Code": { + "CLI": "Set-CsTeamsMeetingPolicy -Identity Global -AllowAnonymousUsersToStartMeeting $false", + "NativeIaC": "", + "Other": "1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click to expand Meetings select Meeting policies. 3. Click Global (Org-wide default). 4. Under meeting join & lobby set Anonymous users and dial-in callers can start a meeting to Off.", + "Terraform": "" + }, + "Recommendation": { + "Text": "Ensure that anonymous users and dial-in callers are required to wait in the lobby until a verified user from the organization or a trusted external domain starts the meeting. This reduces the risk of abuse and maintains meeting integrity.", + "Url": "https://learn.microsoft.com/en-us/powershell/module/teams/set-csteamsmeetingpolicy?view=teams-ps" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "" +} diff --git a/prowler/providers/m365/services/teams/teams_meeting_anonymous_user_start_disabled/teams_meeting_anonymous_user_start_disabled.py b/prowler/providers/m365/services/teams/teams_meeting_anonymous_user_start_disabled/teams_meeting_anonymous_user_start_disabled.py new file mode 100644 index 0000000000..cae9198a54 --- /dev/null +++ b/prowler/providers/m365/services/teams/teams_meeting_anonymous_user_start_disabled/teams_meeting_anonymous_user_start_disabled.py @@ -0,0 +1,40 @@ +from typing import List + +from prowler.lib.check.models import Check, CheckReportM365 +from prowler.providers.m365.services.teams.teams_client import teams_client + + +class teams_meeting_anonymous_user_start_disabled(Check): + """Check if anonymous users are not able to start meetings. + + Attributes: + metadata: Metadata associated with the check (inherited from Check). + """ + + def execute(self) -> List[CheckReportM365]: + """Execute the check for anonymous users are not able to start meetings. + + This method checks if anonymous users and dial-in callers are not able to start meetings. + + Returns: + List[CheckReportM365]: A list of reports containing the result of the check. + """ + findings = [] + global_meeting_policy = teams_client.global_meeting_policy + if global_meeting_policy: + report = CheckReportM365( + metadata=self.metadata(), + resource=global_meeting_policy if global_meeting_policy else {}, + resource_name="Teams Meetings Global (Org-wide default) Policy", + resource_id="teamsMeetingsGlobalPolicy", + ) + report.status = "FAIL" + report.status_extended = "Anonymous Teams users can start meetings." + + if not global_meeting_policy.allow_anonymous_users_to_start_meeting: + report.status = "PASS" + report.status_extended = "Anonymous Teams users can not start meetings." + + findings.append(report) + + return findings diff --git a/prowler/providers/m365/services/teams/teams_service.py b/prowler/providers/m365/services/teams/teams_service.py index 81e5797e64..7231176b9a 100644 --- a/prowler/providers/m365/services/teams/teams_service.py +++ b/prowler/providers/m365/services/teams/teams_service.py @@ -48,7 +48,10 @@ class Teams(M365Service): global_meeting_policy = GlobalMeetingPolicy( allow_anonymous_users_to_join_meeting=global_meeting_policy.get( "AllowAnonymousUsersToJoinMeeting", True - ) + ), + allow_anonymous_users_to_start_meeting=global_meeting_policy.get( + "AllowAnonymousUsersToStartMeeting", True + ), ) except Exception as error: logger.error( @@ -91,6 +94,7 @@ class TeamsSettings(BaseModel): class GlobalMeetingPolicy(BaseModel): allow_anonymous_users_to_join_meeting: bool = True + allow_anonymous_users_to_start_meeting: bool = True class UserSettings(BaseModel): diff --git a/tests/providers/m365/services/teams/teams_meeting_anonymous_user_start_disabled/teams_meeting_anonymous_user_start_disabled_test.py b/tests/providers/m365/services/teams/teams_meeting_anonymous_user_start_disabled/teams_meeting_anonymous_user_start_disabled_test.py new file mode 100644 index 0000000000..6eda43d319 --- /dev/null +++ b/tests/providers/m365/services/teams/teams_meeting_anonymous_user_start_disabled/teams_meeting_anonymous_user_start_disabled_test.py @@ -0,0 +1,117 @@ +from unittest import mock + +from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider + + +class Test_teams_meeting_anonymous_user_start_disabled: + def test_no_global_meeting_policy(self): + teams_client = mock.MagicMock() + teams_client.global_meeting_policy = None + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_m365_provider(), + ), + mock.patch( + "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_microsoft_teams" + ), + mock.patch( + "prowler.providers.m365.services.teams.teams_meeting_anonymous_user_start_disabled.teams_meeting_anonymous_user_start_disabled.teams_client", + new=teams_client, + ), + ): + from prowler.providers.m365.services.teams.teams_meeting_anonymous_user_start_disabled.teams_meeting_anonymous_user_start_disabled import ( + teams_meeting_anonymous_user_start_disabled, + ) + + check = teams_meeting_anonymous_user_start_disabled() + result = check.execute() + assert len(result) == 0 + + def test_anonymous_users_can_start_meetings(self): + teams_client = mock.MagicMock() + teams_client.audited_tenant = "audited_tenant" + teams_client.audited_domain = DOMAIN + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_m365_provider(), + ), + mock.patch( + "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_microsoft_teams" + ), + mock.patch( + "prowler.providers.m365.services.teams.teams_meeting_anonymous_user_start_disabled.teams_meeting_anonymous_user_start_disabled.teams_client", + new=teams_client, + ), + ): + from prowler.providers.m365.services.teams.teams_meeting_anonymous_user_start_disabled.teams_meeting_anonymous_user_start_disabled import ( + teams_meeting_anonymous_user_start_disabled, + ) + from prowler.providers.m365.services.teams.teams_service import ( + GlobalMeetingPolicy, + ) + + teams_client.global_meeting_policy = GlobalMeetingPolicy( + allow_anonymous_users_to_start_meeting=True + ) + + check = teams_meeting_anonymous_user_start_disabled() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended == "Anonymous Teams users can start meetings." + ) + assert result[0].resource == teams_client.global_meeting_policy.dict() + assert ( + result[0].resource_name + == "Teams Meetings Global (Org-wide default) Policy" + ) + assert result[0].resource_id == "teamsMeetingsGlobalPolicy" + + def test_anonymous_users_cannot_start_meetings(self): + teams_client = mock.MagicMock() + teams_client.audited_tenant = "audited_tenant" + teams_client.audited_domain = DOMAIN + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_m365_provider(), + ), + mock.patch( + "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_microsoft_teams" + ), + mock.patch( + "prowler.providers.m365.services.teams.teams_meeting_anonymous_user_start_disabled.teams_meeting_anonymous_user_start_disabled.teams_client", + new=teams_client, + ), + ): + from prowler.providers.m365.services.teams.teams_meeting_anonymous_user_start_disabled.teams_meeting_anonymous_user_start_disabled import ( + teams_meeting_anonymous_user_start_disabled, + ) + from prowler.providers.m365.services.teams.teams_service import ( + GlobalMeetingPolicy, + ) + + teams_client.global_meeting_policy = GlobalMeetingPolicy( + allow_anonymous_users_to_start_meeting=False + ) + + check = teams_meeting_anonymous_user_start_disabled() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == "Anonymous Teams users can not start meetings." + ) + assert result[0].resource == teams_client.global_meeting_policy.dict() + assert ( + result[0].resource_name + == "Teams Meetings Global (Org-wide default) Policy" + ) + assert result[0].resource_id == "teamsMeetingsGlobalPolicy" diff --git a/tests/providers/m365/services/teams/teams_service_test.py b/tests/providers/m365/services/teams/teams_service_test.py index a35f7f1a7b..a4b523eaf7 100644 --- a/tests/providers/m365/services/teams/teams_service_test.py +++ b/tests/providers/m365/services/teams/teams_service_test.py @@ -25,7 +25,10 @@ def mock_get_teams_client_configuration(_): def mock_get_global_meeting_policy(_): - return GlobalMeetingPolicy(allow_anonymous_users_to_join_meeting=False) + return GlobalMeetingPolicy( + allow_anonymous_users_to_join_meeting=False, + allow_anonymous_users_to_start_meeting=False, + ) def mock_get_user_settings(_): @@ -117,6 +120,7 @@ class Test_Teams_Service: ) ) assert teams_client.global_meeting_policy == GlobalMeetingPolicy( - allow_anonymous_users_to_join_meeting=False + allow_anonymous_users_to_join_meeting=False, + allow_anonymous_users_to_start_meeting=False, ) teams_client.powershell.close()