From a78c5499c96bc146808a8a3caf2155c3c9570996 Mon Sep 17 00:00:00 2001 From: Andoni Alonso <14891798+andoniaf@users.noreply.github.com> Date: Fri, 25 Apr 2025 20:34:05 +0200 Subject: [PATCH] feat(teams): add new check `teams_meeting_presenters_restricted` (#7613) Co-authored-by: Sergio Garcia --- prowler/CHANGELOG.md | 1 + .../__init__.py | 0 ...eeting_presenters_restricted.metadata.json | 30 +++++ .../teams_meeting_presenters_restricted.py | 47 +++++++ .../m365/services/teams/teams_service.py | 4 + ...eams_meeting_presenters_restricted_test.py | 118 ++++++++++++++++++ .../m365/services/teams/teams_service_test.py | 2 + 7 files changed, 202 insertions(+) create mode 100644 prowler/providers/m365/services/teams/teams_meeting_presenters_restricted/__init__.py create mode 100644 prowler/providers/m365/services/teams/teams_meeting_presenters_restricted/teams_meeting_presenters_restricted.metadata.json create mode 100644 prowler/providers/m365/services/teams/teams_meeting_presenters_restricted/teams_meeting_presenters_restricted.py create mode 100644 tests/providers/m365/services/teams/teams_meeting_presenters_restricted/teams_meeting_presenters_restricted_test.py diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 1a45c7cfb0..ca04641ce4 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -33,6 +33,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Add new check `teams_meeting_external_control_disabled` [(#7604)](https://github.com/prowler-cloud/prowler/pull/7604) - Add new check `teams_meeting_external_chat_disabled` [(#7605)](https://github.com/prowler-cloud/prowler/pull/7605) - Add new check `teams_meeting_recording_disabled` [(#7607)](https://github.com/prowler-cloud/prowler/pull/7607) +- Add new check `teams_meeting_presenters_restricted` [(#7613)](https://github.com/prowler-cloud/prowler/pull/7613) - Add new check `teams_meeting_chat_anonymous_users_disabled` [(#7579)](https://github.com/prowler-cloud/prowler/pull/7579) ### Fixed diff --git a/prowler/providers/m365/services/teams/teams_meeting_presenters_restricted/__init__.py b/prowler/providers/m365/services/teams/teams_meeting_presenters_restricted/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/m365/services/teams/teams_meeting_presenters_restricted/teams_meeting_presenters_restricted.metadata.json b/prowler/providers/m365/services/teams/teams_meeting_presenters_restricted/teams_meeting_presenters_restricted.metadata.json new file mode 100644 index 0000000000..d1117d0e2a --- /dev/null +++ b/prowler/providers/m365/services/teams/teams_meeting_presenters_restricted/teams_meeting_presenters_restricted.metadata.json @@ -0,0 +1,30 @@ +{ + "Provider": "m365", + "CheckID": "teams_meeting_presenters_restricted", + "CheckTitle": "Ensure only organizers and co-organizers can present", + "CheckType": [], + "ServiceName": "teams", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "Teams Global Meeting Policy", + "Description": "Ensure only organizers and co-organizers can present in a Teams meeting. The recommended state is 'Only organizers and co-organizers'.", + "Risk": "Allowing everyone to present increases the risk that a malicious user can inadvertently show inappropriate content.", + "RelatedUrl": "https://learn.microsoft.com/en-us/microsoftteams/meeting-who-present-request-control", + "Remediation": { + "Code": { + "CLI": "Set-CsTeamsMeetingPolicy -Identity Global -DesignatedPresenterRoleMode \"OrganizerOnlyUserOverride\"", + "NativeIaC": "", + "Other": "1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click to expand Meetings select Meeting policies. 3. Click Global (Org-wide default). 4. Under content sharing set Who can present to Only organizers and co-organizers.", + "Terraform": "" + }, + "Recommendation": { + "Text": "Restrict presentation capabilities to only organizers and co-organizers to reduce the risk of inappropriate content being shown.", + "Url": "https://learn.microsoft.com/en-us/microsoftteams/meeting-who-present-request-control" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "" +} diff --git a/prowler/providers/m365/services/teams/teams_meeting_presenters_restricted/teams_meeting_presenters_restricted.py b/prowler/providers/m365/services/teams/teams_meeting_presenters_restricted/teams_meeting_presenters_restricted.py new file mode 100644 index 0000000000..bfbdd169f2 --- /dev/null +++ b/prowler/providers/m365/services/teams/teams_meeting_presenters_restricted/teams_meeting_presenters_restricted.py @@ -0,0 +1,47 @@ +from typing import List + +from prowler.lib.check.models import Check, CheckReportM365 +from prowler.providers.m365.services.teams.teams_client import teams_client + + +class teams_meeting_presenters_restricted(Check): + """Check if only organizers and co-organizers can present. + + Attributes: + metadata: Metadata associated with the check (inherited from Check). + """ + + def execute(self) -> List[CheckReportM365]: + """Execute the check for meeting presenter settings. + + This method checks if only organizers and co-organizers can present. + + Returns: + List[CheckReportM365]: A list of reports containing the result of the check. + """ + findings = [] + global_meeting_policy = teams_client.global_meeting_policy + if global_meeting_policy: + report = CheckReportM365( + metadata=self.metadata(), + resource=global_meeting_policy if global_meeting_policy else {}, + resource_name="Teams Meetings Global (Org-wide default) Policy", + resource_id="teamsMeetingsGlobalPolicy", + ) + report.status = "FAIL" + report.status_extended = ( + "Not only organizers and co-organizers can present." + ) + + if ( + global_meeting_policy.designated_presenter_role_mode + == "OrganizerOnlyUserOverride" + ): + report.status = "PASS" + report.status_extended = ( + "Only organizers and co-organizers can present." + ) + + findings.append(report) + + return findings diff --git a/prowler/providers/m365/services/teams/teams_service.py b/prowler/providers/m365/services/teams/teams_service.py index 408a44d20e..ad2d7b3721 100644 --- a/prowler/providers/m365/services/teams/teams_service.py +++ b/prowler/providers/m365/services/teams/teams_service.py @@ -72,6 +72,9 @@ class Teams(M365Service): allow_cloud_recording=global_meeting_policy.get( "AllowCloudRecording", True ), + designated_presenter_role_mode=global_meeting_policy.get( + "DesignatedPresenterRoleMode", "EveryoneUserOverride" + ), meeting_chat_enabled_type=global_meeting_policy.get( "MeetingChatEnabledType", "EnabledForEveryone" ), @@ -121,6 +124,7 @@ class GlobalMeetingPolicy(BaseModel): allow_external_participant_give_request_control: bool = True allow_external_non_trusted_meeting_chat: bool = True allow_cloud_recording: bool = True + designated_presenter_role_mode: str = "EveryoneUserOverride" allow_external_users_to_bypass_lobby: str = "Everyone" allow_pstn_users_to_bypass_lobby: bool = True meeting_chat_enabled_type: str = "EnabledForEveryone" diff --git a/tests/providers/m365/services/teams/teams_meeting_presenters_restricted/teams_meeting_presenters_restricted_test.py b/tests/providers/m365/services/teams/teams_meeting_presenters_restricted/teams_meeting_presenters_restricted_test.py new file mode 100644 index 0000000000..5c47f1e445 --- /dev/null +++ b/tests/providers/m365/services/teams/teams_meeting_presenters_restricted/teams_meeting_presenters_restricted_test.py @@ -0,0 +1,118 @@ +from unittest import mock + +from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider + + +class Test_teams_meeting_presenters_restricted: + def test_no_global_meeting_policy(self): + teams_client = mock.MagicMock() + teams_client.global_meeting_policy = None + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_m365_provider(), + ), + mock.patch( + "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_microsoft_teams" + ), + mock.patch( + "prowler.providers.m365.services.teams.teams_meeting_presenters_restricted.teams_meeting_presenters_restricted.teams_client", + new=teams_client, + ), + ): + from prowler.providers.m365.services.teams.teams_meeting_presenters_restricted.teams_meeting_presenters_restricted import ( + teams_meeting_presenters_restricted, + ) + + check = teams_meeting_presenters_restricted() + result = check.execute() + assert len(result) == 0 + + def test_presenters_not_restricted(self): + teams_client = mock.MagicMock() + teams_client.audited_tenant = "audited_tenant" + teams_client.audited_domain = DOMAIN + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_m365_provider(), + ), + mock.patch( + "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_microsoft_teams" + ), + mock.patch( + "prowler.providers.m365.services.teams.teams_meeting_presenters_restricted.teams_meeting_presenters_restricted.teams_client", + new=teams_client, + ), + ): + from prowler.providers.m365.services.teams.teams_meeting_presenters_restricted.teams_meeting_presenters_restricted import ( + teams_meeting_presenters_restricted, + ) + from prowler.providers.m365.services.teams.teams_service import ( + GlobalMeetingPolicy, + ) + + teams_client.global_meeting_policy = GlobalMeetingPolicy( + designated_presenter_role_mode="EveryoneUserOverride" + ) + + check = teams_meeting_presenters_restricted() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == "Not only organizers and co-organizers can present." + ) + assert result[0].resource == teams_client.global_meeting_policy.dict() + assert ( + result[0].resource_name + == "Teams Meetings Global (Org-wide default) Policy" + ) + assert result[0].resource_id == "teamsMeetingsGlobalPolicy" + + def test_presenters_restricted(self): + teams_client = mock.MagicMock() + teams_client.audited_tenant = "audited_tenant" + teams_client.audited_domain = DOMAIN + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_m365_provider(), + ), + mock.patch( + "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_microsoft_teams" + ), + mock.patch( + "prowler.providers.m365.services.teams.teams_meeting_presenters_restricted.teams_meeting_presenters_restricted.teams_client", + new=teams_client, + ), + ): + from prowler.providers.m365.services.teams.teams_meeting_presenters_restricted.teams_meeting_presenters_restricted import ( + teams_meeting_presenters_restricted, + ) + from prowler.providers.m365.services.teams.teams_service import ( + GlobalMeetingPolicy, + ) + + teams_client.global_meeting_policy = GlobalMeetingPolicy( + designated_presenter_role_mode="OrganizerOnlyUserOverride" + ) + + check = teams_meeting_presenters_restricted() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == "Only organizers and co-organizers can present." + ) + assert result[0].resource == teams_client.global_meeting_policy.dict() + assert ( + result[0].resource_name + == "Teams Meetings Global (Org-wide default) Policy" + ) + assert result[0].resource_id == "teamsMeetingsGlobalPolicy" diff --git a/tests/providers/m365/services/teams/teams_service_test.py b/tests/providers/m365/services/teams/teams_service_test.py index badb0f74bf..a87e51ca33 100644 --- a/tests/providers/m365/services/teams/teams_service_test.py +++ b/tests/providers/m365/services/teams/teams_service_test.py @@ -31,6 +31,7 @@ def mock_get_global_meeting_policy(_): allow_external_participant_give_request_control=False, allow_external_non_trusted_meeting_chat=False, allow_cloud_recording=False, + designated_presenter_role_mode="EveryoneUserOverride", allow_external_users_to_bypass_lobby="EveryoneInCompanyExcludingGuests", allow_pstn_users_to_bypass_lobby=False, meeting_chat_enabled_type="EnabledExceptAnonymous", @@ -131,6 +132,7 @@ class Test_Teams_Service: allow_external_participant_give_request_control=False, allow_external_non_trusted_meeting_chat=False, allow_cloud_recording=False, + designated_presenter_role_mode="EveryoneUserOverride", allow_external_users_to_bypass_lobby="EveryoneInCompanyExcludingGuests", allow_pstn_users_to_bypass_lobby=False, meeting_chat_enabled_type="EnabledExceptAnonymous",