feat(sharepoint): add new check related with OneDrive Sync (#7589)

Co-authored-by: Andoni A. <14891798+andoniaf@users.noreply.github.com>

tests/providers/m365/services/sharepoint/sharepoint_external_sharing_managed/sharepoint_external_sharing_managed_test.py

@@ -1,3 +1,4 @@
+import uuid
 from unittest import mock
 
 from prowler.providers.m365.services.sharepoint.sharepoint_service import (
@@ -35,6 +36,7 @@ class Test_sharepoint_external_sharing_managed:
                 legacyAuth=True,
                 resharingEnabled=False,
                 sharingDomainRestrictionMode="none",
+                allowedDomainGuidsForSyncApp=[uuid.uuid4()],
             )
             sharepoint_client.tenant_domain = DOMAIN
 
@@ -80,6 +82,7 @@ class Test_sharepoint_external_sharing_managed:
                 legacyAuth=True,
                 resharingEnabled=False,
                 sharingDomainRestrictionMode="allowList",
+                allowedDomainGuidsForSyncApp=[uuid.uuid4()],
             )
             sharepoint_client.tenant_domain = DOMAIN
 
@@ -125,6 +128,7 @@ class Test_sharepoint_external_sharing_managed:
                 legacyAuth=True,
                 resharingEnabled=False,
                 sharingDomainRestrictionMode="blockList",
+                allowedDomainGuidsForSyncApp=[uuid.uuid4()],
             )
             sharepoint_client.tenant_domain = DOMAIN
 
@@ -170,6 +174,7 @@ class Test_sharepoint_external_sharing_managed:
                 legacyAuth=True,
                 resharingEnabled=False,
                 sharingDomainRestrictionMode="allowList",
+                allowedDomainGuidsForSyncApp=[uuid.uuid4()],
             )
             sharepoint_client.tenant_domain = DOMAIN
 
@@ -215,6 +220,7 @@ class Test_sharepoint_external_sharing_managed:
                 legacyAuth=True,
                 resharingEnabled=False,
                 sharingDomainRestrictionMode="blockList",
+                allowedDomainGuidsForSyncApp=[uuid.uuid4()],
             )
             sharepoint_client.tenant_domain = DOMAIN
 

tests/providers/m365/services/sharepoint/sharepoint_external_sharing_restricted/sharepoint_external_sharing_restricted_test.py

@@ -1,3 +1,4 @@
+import uuid
 from unittest import mock
 
 from prowler.providers.m365.services.sharepoint.sharepoint_service import (
@@ -35,6 +36,7 @@ class Test_sharepoint_external_sharing_restricted:
                 sharingDomainRestrictionMode="allowList",
                 resharingEnabled=False,
                 legacyAuth=True,
+                allowedDomainGuidsForSyncApp=[uuid.uuid4()],
             )
             sharepoint_client.tenant_domain = DOMAIN
 
@@ -78,6 +80,7 @@ class Test_sharepoint_external_sharing_restricted:
                 sharingDomainRestrictionMode="allowList",
                 resharingEnabled=False,
                 legacyAuth=True,
+                allowedDomainGuidsForSyncApp=[uuid.uuid4()],
             )
             sharepoint_client.tenant_domain = DOMAIN
 

tests/providers/m365/services/sharepoint/sharepoint_guest_sharing_restricted/sharepoint_guest_sharing_restricted_test.py

@@ -1,3 +1,4 @@
+import uuid
 from unittest import mock
 
 from prowler.providers.m365.services.sharepoint.sharepoint_service import (
@@ -35,6 +36,7 @@ class Test_sharepoint_guest_sharing_restricted:
                 sharingDomainRestrictionMode="allowList",
                 legacyAuth=True,
                 resharingEnabled=False,
+                allowedDomainGuidsForSyncApp=[uuid.uuid4()],
             )
             sharepoint_client.tenant_domain = DOMAIN
 
@@ -79,6 +81,7 @@ class Test_sharepoint_guest_sharing_restricted:
                 sharingDomainRestrictionMode="allowList",
                 legacyAuth=True,
                 resharingEnabled=True,
+                allowedDomainGuidsForSyncApp=[uuid.uuid4()],
             )
             sharepoint_client.tenant_domain = DOMAIN
 

tests/providers/m365/services/sharepoint/sharepoint_modern_authentication_required/sharepoint_modern_authentication_required_test.py

@@ -1,3 +1,4 @@
+import uuid
 from unittest import mock
 
 from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider
@@ -35,6 +36,7 @@ class Test_sharepoint_modern_authentication_required:
                 sharingDomainRestrictionMode="allowList",
                 resharingEnabled=False,
                 legacyAuth=False,
+                allowedDomainGuidsForSyncApp=[uuid.uuid4()],
             )
             sharepoint_client.tenant_domain = DOMAIN
 
@@ -81,6 +83,7 @@ class Test_sharepoint_modern_authentication_required:
                 sharingDomainRestrictionMode="allowList",
                 resharingEnabled=False,
                 legacyAuth=True,
+                allowedDomainGuidsForSyncApp=[uuid.uuid4()],
             )
             sharepoint_client.tenant_domain = DOMAIN
 

tests/providers/m365/services/sharepoint/sharepoint_onedrive_sync_restricted_unmanaged_devices/sharepoint_onedrive_sync_restricted_unmanaged_devices_test.py

@@ -0,0 +1,129 @@
+import uuid
+from unittest import mock
+
+from prowler.providers.m365.services.sharepoint.sharepoint_service import (
+    SharePointSettings,
+)
+from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider
+
+
+class Test_sharepoint_onedrive_sync_restricted_unmanaged_devices:
+    def test_no_allowed_domain_guids(self):
+        """
+        Test when there are no allowed domain guids for OneDrive sync app
+
+
+        """
+        sharepoint_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.sharepoint.sharepoint_onedrive_sync_restricted_unmanaged_devices.sharepoint_onedrive_sync_restricted_unmanaged_devices.sharepoint_client",
+                new=sharepoint_client,
+            ),
+        ):
+            from prowler.providers.m365.services.sharepoint.sharepoint_onedrive_sync_restricted_unmanaged_devices.sharepoint_onedrive_sync_restricted_unmanaged_devices import (
+                sharepoint_onedrive_sync_restricted_unmanaged_devices,
+            )
+
+            sharepoint_client.settings = SharePointSettings(
+                sharingCapability="ExternalUserSharingOnly",
+                sharingAllowedDomainList=["allowed-domain.com"],
+                sharingBlockedDomainList=["blocked-domain.com"],
+                legacyAuth=True,
+                resharingEnabled=False,
+                sharingDomainRestrictionMode="none",
+                allowedDomainGuidsForSyncApp=[],
+            )
+            sharepoint_client.tenant_domain = DOMAIN
+
+            check = sharepoint_onedrive_sync_restricted_unmanaged_devices()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "Microsoft 365 SharePoint allows OneDrive sync to unmanaged devices."
+            )
+            assert result[0].resource_id == DOMAIN
+            assert result[0].location == "global"
+            assert result[0].resource_name == "SharePoint Settings"
+            assert result[0].resource == sharepoint_client.settings.dict()
+
+    def test_allowed_domain_guids(self):
+        """
+        Test when there are allowed domain guids for OneDrive sync app
+        """
+        sharepoint_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.sharepoint.sharepoint_onedrive_sync_restricted_unmanaged_devices.sharepoint_onedrive_sync_restricted_unmanaged_devices.sharepoint_client",
+                new=sharepoint_client,
+            ),
+        ):
+            from prowler.providers.m365.services.sharepoint.sharepoint_onedrive_sync_restricted_unmanaged_devices.sharepoint_onedrive_sync_restricted_unmanaged_devices import (
+                sharepoint_onedrive_sync_restricted_unmanaged_devices,
+            )
+
+            sharepoint_client.settings = SharePointSettings(
+                sharingCapability="ExternalUserSharingOnly",
+                sharingAllowedDomainList=[],
+                sharingBlockedDomainList=["blocked-domain.com"],
+                legacyAuth=True,
+                resharingEnabled=False,
+                sharingDomainRestrictionMode="allowList",
+                allowedDomainGuidsForSyncApp=[uuid.uuid4()],
+            )
+            sharepoint_client.tenant_domain = DOMAIN
+
+            check = sharepoint_onedrive_sync_restricted_unmanaged_devices()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "Microsoft 365 SharePoint does not allow OneDrive sync to unmanaged devices."
+            )
+            assert result[0].resource_id == DOMAIN
+            assert result[0].location == "global"
+            assert result[0].resource_name == "SharePoint Settings"
+            assert result[0].resource == sharepoint_client.settings.dict()
+
+    def test_empty_settings(self):
+        """
+        Test when sharepoint_client.settings is empty:
+        The check should return an empty list of findings.
+        """
+        sharepoint_client = mock.MagicMock
+        sharepoint_client.settings = {}
+        sharepoint_client.tenant_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.sharepoint.sharepoint_onedrive_sync_restricted_unmanaged_devices.sharepoint_onedrive_sync_restricted_unmanaged_devices.sharepoint_client",
+                new=sharepoint_client,
+            ),
+        ):
+            from prowler.providers.m365.services.sharepoint.sharepoint_onedrive_sync_restricted_unmanaged_devices.sharepoint_onedrive_sync_restricted_unmanaged_devices import (
+                sharepoint_onedrive_sync_restricted_unmanaged_devices,
+            )
+
+            check = sharepoint_onedrive_sync_restricted_unmanaged_devices()
+            result = check.execute()
+
+            assert len(result) == 0

tests/providers/m365/services/sharepoint/sharepoint_service_test.py

@@ -1,3 +1,4 @@
+import uuid
 from unittest.mock import patch
 
 from prowler.providers.m365.models import M365IdentityInfo
@@ -7,6 +8,8 @@ from prowler.providers.m365.services.sharepoint.sharepoint_service import (
 )
 from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider
 
+uuid_value = uuid.uuid4()
+
 
 async def mock_sharepoint_get_settings(_):
     return SharePointSettings(
@@ -16,6 +19,7 @@ async def mock_sharepoint_get_settings(_):
         sharingDomainRestrictionMode="allowList",
         resharingEnabled=False,
         legacyAuth=True,
+        allowedDomainGuidsForSyncApp=[uuid_value],
     )
 
 
@@ -39,3 +43,5 @@ class Test_SharePoint_Service:
         assert settings.sharingDomainRestrictionMode == "allowList"
         assert settings.resharingEnabled is False
         assert settings.legacyAuth is True
+        assert settings.allowedDomainGuidsForSyncApp == [uuid_value]
+        assert len(settings.allowedDomainGuidsForSyncApp) == 1