feat(entra): add new check entra_managed_device_required_for_mfa_registration (#7203)

Co-authored-by: MrCloudSec <hello@mistercloudsec.com>

tests/providers/microsoft365/services/entra/entra_admin_mfa_enabled_for_administrative_roles/entra_admin_mfa_enabled_for_administrative_roles_test.py

@@ -7,8 +7,8 @@ from prowler.providers.microsoft365.services.entra.entra_service import (
     ConditionalAccessPolicy,
     ConditionalAccessPolicyState,
     Conditions,
-    GrantControls,
     GrantControlOperator,
+    GrantControls,
     PersistentBrowser,
     SessionControls,
     SignInFrequency,
@@ -84,7 +84,9 @@ class Test_entra_admin_mfa_enabled_for_administrative_roles:
                     display_name="Disabled Policy",
                     conditions=Conditions(
                         application_conditions=ApplicationsConditions(
-                            included_applications=["All"], excluded_applications=[]
+                            included_applications=["All"],
+                            excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],
@@ -158,7 +160,9 @@ class Test_entra_admin_mfa_enabled_for_administrative_roles:
                     display_name="No Admin Roles Policy",
                     conditions=Conditions(
                         application_conditions=ApplicationsConditions(
-                            included_applications=["All"], excluded_applications=[]
+                            included_applications=["All"],
+                            excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],
@@ -234,6 +238,7 @@ class Test_entra_admin_mfa_enabled_for_administrative_roles:
                         application_conditions=ApplicationsConditions(
                             included_applications=["MicrosoftAdminPortals"],
                             excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],
@@ -312,7 +317,9 @@ class Test_entra_admin_mfa_enabled_for_administrative_roles:
                     display_name=display_name,
                     conditions=Conditions(
                         application_conditions=ApplicationsConditions(
-                            included_applications=["All"], excluded_applications=[]
+                            included_applications=["All"],
+                            excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],
@@ -389,7 +396,9 @@ class Test_entra_admin_mfa_enabled_for_administrative_roles:
                     display_name=display_name,
                     conditions=Conditions(
                         application_conditions=ApplicationsConditions(
-                            included_applications=["All"], excluded_applications=[]
+                            included_applications=["All"],
+                            excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],
@@ -482,7 +491,9 @@ class Test_entra_admin_mfa_enabled_for_administrative_roles:
                     display_name=display_name,
                     conditions=Conditions(
                         application_conditions=ApplicationsConditions(
-                            included_applications=["All"], excluded_applications=[]
+                            included_applications=["All"],
+                            excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],

tests/providers/microsoft365/services/entra/entra_admin_portals_role_limited_access/entra_admin_portals_role_limited_access_test.py

@@ -83,7 +83,9 @@ class Test_entra_admin_portals_role_limited_access:
                     display_name="Test",
                     conditions=Conditions(
                         application_conditions=ApplicationsConditions(
-                            included_applications=[], excluded_applications=[]
+                            included_applications=[],
+                            excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],
@@ -157,6 +159,7 @@ class Test_entra_admin_portals_role_limited_access:
                         application_conditions=ApplicationsConditions(
                             included_applications=["MicrosoftAdminPortals"],
                             excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],
@@ -234,6 +237,7 @@ class Test_entra_admin_portals_role_limited_access:
                         application_conditions=ApplicationsConditions(
                             included_applications=["MicrosoftAdminPortals"],
                             excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],

tests/providers/microsoft365/services/entra/entra_admin_users_sign_in_frequency_enabled/entra_admin_users_sign_in_frequency_enabled_test.py

@@ -85,7 +85,9 @@ class Test_entra_admin_users_sign_in_frequency_enabled:
                     display_name="Test",
                     conditions=Conditions(
                         application_conditions=ApplicationsConditions(
-                            included_applications=[], excluded_applications=[]
+                            included_applications=[],
+                            excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],
@@ -159,7 +161,9 @@ class Test_entra_admin_users_sign_in_frequency_enabled:
                     display_name=display_name,
                     conditions=Conditions(
                         application_conditions=ApplicationsConditions(
-                            included_applications=["All"], excluded_applications=[]
+                            included_applications=["All"],
+                            excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],
@@ -255,7 +259,9 @@ class Test_entra_admin_users_sign_in_frequency_enabled:
                     display_name=display_name,
                     conditions=Conditions(
                         application_conditions=ApplicationsConditions(
-                            included_applications=["All"], excluded_applications=[]
+                            included_applications=["All"],
+                            excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],
@@ -348,7 +354,9 @@ class Test_entra_admin_users_sign_in_frequency_enabled:
                     display_name=display_name,
                     conditions=Conditions(
                         application_conditions=ApplicationsConditions(
-                            included_applications=["All"], excluded_applications=[]
+                            included_applications=["All"],
+                            excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],
@@ -441,7 +449,9 @@ class Test_entra_admin_users_sign_in_frequency_enabled:
                     display_name=display_name,
                     conditions=Conditions(
                         application_conditions=ApplicationsConditions(
-                            included_applications=["All"], excluded_applications=[]
+                            included_applications=["All"],
+                            excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],
@@ -537,7 +547,9 @@ class Test_entra_admin_users_sign_in_frequency_enabled:
                     display_name=display_name,
                     conditions=Conditions(
                         application_conditions=ApplicationsConditions(
-                            included_applications=["All"], excluded_applications=[]
+                            included_applications=["All"],
+                            excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],

tests/providers/microsoft365/services/entra/entra_identity_protection_sign_in_risk_enabled/entra_identity_protection_sign_in_risk_enabled_test.py

@@ -84,7 +84,9 @@ class Test_entra_identity_protection_sign_in_risk_enabled:
                     display_name="Test",
                     conditions=Conditions(
                         application_conditions=ApplicationsConditions(
-                            included_applications=[], excluded_applications=[]
+                            included_applications=[],
+                            excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],
@@ -160,6 +162,7 @@ class Test_entra_identity_protection_sign_in_risk_enabled:
                         application_conditions=ApplicationsConditions(
                             included_applications=["All"],
                             excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],
@@ -242,6 +245,7 @@ class Test_entra_identity_protection_sign_in_risk_enabled:
                         application_conditions=ApplicationsConditions(
                             included_applications=["All"],
                             excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],
@@ -324,6 +328,7 @@ class Test_entra_identity_protection_sign_in_risk_enabled:
                         application_conditions=ApplicationsConditions(
                             included_applications=["All"],
                             excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],

tests/providers/microsoft365/services/entra/entra_identity_protection_user_risk_enabled/entra_identity_protection_user_risk_enabled_test.py

@@ -84,7 +84,9 @@ class Test_entra_identity_protection_user_risk_enabled:
                     display_name="Test",
                     conditions=Conditions(
                         application_conditions=ApplicationsConditions(
-                            included_applications=[], excluded_applications=[]
+                            included_applications=[],
+                            excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],
@@ -159,6 +161,7 @@ class Test_entra_identity_protection_user_risk_enabled:
                         application_conditions=ApplicationsConditions(
                             included_applications=["All"],
                             excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],
@@ -240,6 +243,7 @@ class Test_entra_identity_protection_user_risk_enabled:
                         application_conditions=ApplicationsConditions(
                             included_applications=["All"],
                             excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],
@@ -321,6 +325,7 @@ class Test_entra_identity_protection_user_risk_enabled:
                         application_conditions=ApplicationsConditions(
                             included_applications=["All"],
                             excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],

tests/providers/microsoft365/services/entra/entra_managed_device_required_for_authentication/entra_managed_device_required_for_authentication_test.py

@@ -83,7 +83,9 @@ class Test_entra_managed_device_required_for_authentication:
                     display_name="Test",
                     conditions=Conditions(
                         application_conditions=ApplicationsConditions(
-                            included_applications=[], excluded_applications=[]
+                            included_applications=[],
+                            excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],
@@ -157,6 +159,7 @@ class Test_entra_managed_device_required_for_authentication:
                         application_conditions=ApplicationsConditions(
                             included_applications=["All"],
                             excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],
@@ -238,6 +241,7 @@ class Test_entra_managed_device_required_for_authentication:
                         application_conditions=ApplicationsConditions(
                             included_applications=["All"],
                             excluded_applications=[],
+                            included_user_actions=[],
                         ),
                         user_conditions=UsersConditions(
                             included_groups=[],

tests/providers/microsoft365/services/entra/entra_managed_device_required_for_mfa_registration/entra_managed_device_required_for_mfa_registration_test.py

@@ -0,0 +1,293 @@
+from unittest import mock
+from uuid import uuid4
+
+from prowler.providers.microsoft365.services.entra.entra_service import (
+    ApplicationsConditions,
+    ConditionalAccessGrantControl,
+    ConditionalAccessPolicyState,
+    Conditions,
+    GrantControlOperator,
+    GrantControls,
+    PersistentBrowser,
+    SessionControls,
+    SignInFrequency,
+    SignInFrequencyInterval,
+    UserAction,
+    UsersConditions,
+)
+from tests.providers.microsoft365.microsoft365_fixtures import (
+    DOMAIN,
+    set_mocked_microsoft365_provider,
+)
+
+
+class Test_entra_managed_device_required_for_mfa_registration:
+    def test_entra_no_conditional_access_policies(self):
+        entra_client = mock.MagicMock
+        entra_client.audited_tenant = "audited_tenant"
+        entra_client.audited_domain = DOMAIN
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_microsoft365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.microsoft365.services.entra.entra_managed_device_required_for_mfa_registration.entra_managed_device_required_for_mfa_registration.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.microsoft365.services.entra.entra_managed_device_required_for_mfa_registration.entra_managed_device_required_for_mfa_registration import (
+                entra_managed_device_required_for_mfa_registration,
+            )
+
+            entra_client.conditional_access_policies = {}
+
+            check = entra_managed_device_required_for_mfa_registration()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "No Conditional Access Policy requires a managed device for MFA registration."
+            )
+            assert result[0].resource == {}
+            assert result[0].resource_name == "Conditional Access Policies"
+            assert result[0].resource_id == "conditionalAccessPolicies"
+            assert result[0].location == "global"
+
+    def test_entra_managed_device_disabled(self):
+        id = str(uuid4())
+        entra_client = mock.MagicMock
+        entra_client.audited_tenant = "audited_tenant"
+        entra_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_microsoft365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.microsoft365.services.entra.entra_managed_device_required_for_mfa_registration.entra_managed_device_required_for_mfa_registration.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.microsoft365.services.entra.entra_managed_device_required_for_mfa_registration.entra_managed_device_required_for_mfa_registration import (
+                entra_managed_device_required_for_mfa_registration,
+            )
+            from prowler.providers.microsoft365.services.entra.entra_service import (
+                ConditionalAccessPolicy,
+            )
+
+            entra_client.conditional_access_policies = {
+                id: ConditionalAccessPolicy(
+                    id=id,
+                    display_name="Test",
+                    conditions=Conditions(
+                        application_conditions=ApplicationsConditions(
+                            included_applications=[],
+                            excluded_applications=[],
+                            included_user_actions=[],
+                        ),
+                        user_conditions=UsersConditions(
+                            included_groups=[],
+                            excluded_groups=[],
+                            included_users=[],
+                            excluded_users=[],
+                            included_roles=[],
+                            excluded_roles=[],
+                        ),
+                    ),
+                    grant_controls=GrantControls(
+                        built_in_controls=[], operator=GrantControlOperator.OR
+                    ),
+                    session_controls=SessionControls(
+                        persistent_browser=PersistentBrowser(
+                            is_enabled=False, mode="always"
+                        ),
+                        sign_in_frequency=SignInFrequency(
+                            is_enabled=False,
+                            frequency=None,
+                            type=None,
+                            interval=SignInFrequencyInterval.TIME_BASED,
+                        ),
+                    ),
+                    state=ConditionalAccessPolicyState.DISABLED,
+                )
+            }
+
+            check = entra_managed_device_required_for_mfa_registration()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "No Conditional Access Policy requires a managed device for MFA registration."
+            )
+            assert result[0].resource == {}
+            assert result[0].resource_name == "Conditional Access Policies"
+            assert result[0].resource_id == "conditionalAccessPolicies"
+            assert result[0].location == "global"
+
+    def test_entra_managed_device_enabled_for_reporting(self):
+        id = str(uuid4())
+        display_name = "Test"
+        entra_client = mock.MagicMock
+        entra_client.audited_tenant = "audited_tenant"
+        entra_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_microsoft365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.microsoft365.services.entra.entra_managed_device_required_for_mfa_registration.entra_managed_device_required_for_mfa_registration.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.microsoft365.services.entra.entra_managed_device_required_for_mfa_registration.entra_managed_device_required_for_mfa_registration import (
+                entra_managed_device_required_for_mfa_registration,
+            )
+            from prowler.providers.microsoft365.services.entra.entra_service import (
+                ConditionalAccessPolicy,
+            )
+
+            entra_client.conditional_access_policies = {
+                id: ConditionalAccessPolicy(
+                    id=id,
+                    display_name=display_name,
+                    conditions=Conditions(
+                        application_conditions=ApplicationsConditions(
+                            included_applications=["All"],
+                            excluded_applications=[],
+                            included_user_actions=[UserAction.REGISTER_SECURITY_INFO],
+                        ),
+                        user_conditions=UsersConditions(
+                            included_groups=[],
+                            excluded_groups=[],
+                            included_users=["All"],
+                            excluded_users=[],
+                            included_roles=[],
+                            excluded_roles=[],
+                        ),
+                    ),
+                    grant_controls=GrantControls(
+                        built_in_controls=[
+                            ConditionalAccessGrantControl.MFA,
+                            ConditionalAccessGrantControl.DOMAIN_JOINED_DEVICE,
+                        ],
+                        operator=GrantControlOperator.OR,
+                    ),
+                    session_controls=SessionControls(
+                        persistent_browser=PersistentBrowser(
+                            is_enabled=False, mode="always"
+                        ),
+                        sign_in_frequency=SignInFrequency(
+                            is_enabled=False,
+                            frequency=None,
+                            type=None,
+                            interval=SignInFrequencyInterval.TIME_BASED,
+                        ),
+                    ),
+                    state=ConditionalAccessPolicyState.ENABLED_FOR_REPORTING,
+                )
+            }
+
+            check = entra_managed_device_required_for_mfa_registration()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Conditional Access Policy '{display_name}' reports the requirement of a managed device for MFA registration but does not enforce it."
+            )
+            assert (
+                result[0].resource
+                == entra_client.conditional_access_policies[id].dict()
+            )
+
+            assert result[0].resource_name == display_name
+            assert result[0].resource_id == id
+            assert result[0].location == "global"
+
+    def test_entra_managed_device_enabled(self):
+        id = str(uuid4())
+        display_name = "Test"
+        entra_client = mock.MagicMock
+        entra_client.audited_tenant = "audited_tenant"
+        entra_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_microsoft365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.microsoft365.services.entra.entra_managed_device_required_for_mfa_registration.entra_managed_device_required_for_mfa_registration.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.microsoft365.services.entra.entra_managed_device_required_for_mfa_registration.entra_managed_device_required_for_mfa_registration import (
+                entra_managed_device_required_for_mfa_registration,
+            )
+            from prowler.providers.microsoft365.services.entra.entra_service import (
+                ConditionalAccessPolicy,
+            )
+
+            entra_client.conditional_access_policies = {
+                id: ConditionalAccessPolicy(
+                    id=id,
+                    display_name=display_name,
+                    conditions=Conditions(
+                        application_conditions=ApplicationsConditions(
+                            included_applications=["All"],
+                            excluded_applications=[],
+                            included_user_actions=[UserAction.REGISTER_SECURITY_INFO],
+                        ),
+                        user_conditions=UsersConditions(
+                            included_groups=[],
+                            excluded_groups=[],
+                            included_users=["All"],
+                            excluded_users=[],
+                            included_roles=[],
+                            excluded_roles=[],
+                        ),
+                    ),
+                    grant_controls=GrantControls(
+                        built_in_controls=[
+                            ConditionalAccessGrantControl.MFA,
+                            ConditionalAccessGrantControl.DOMAIN_JOINED_DEVICE,
+                        ],
+                        operator=GrantControlOperator.OR,
+                    ),
+                    session_controls=SessionControls(
+                        persistent_browser=PersistentBrowser(
+                            is_enabled=False, mode="always"
+                        ),
+                        sign_in_frequency=SignInFrequency(
+                            is_enabled=False,
+                            frequency=None,
+                            type=None,
+                            interval=SignInFrequencyInterval.TIME_BASED,
+                        ),
+                    ),
+                    state=ConditionalAccessPolicyState.ENABLED,
+                )
+            }
+
+            check = entra_managed_device_required_for_mfa_registration()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Conditional Access Policy '{display_name}' does require a managed device for MFA registration."
+            )
+            assert (
+                result[0].resource
+                == entra_client.conditional_access_policies[id].dict()
+            )
+
+            assert result[0].resource_name == display_name
+            assert result[0].resource_id == id
+            assert result[0].location == "global"

tests/providers/microsoft365/services/entra/microsoft365_entra_service_test.py

@@ -19,6 +19,7 @@ from prowler.providers.microsoft365.services.entra.entra_service import (
     SignInFrequency,
     SignInFrequencyInterval,
     SignInFrequencyType,
+    UserAction,
     UsersConditions,
 )
 from tests.providers.microsoft365.microsoft365_fixtures import (
@@ -42,16 +43,6 @@ async def mock_entra_get_authorization_policy(_):
     )
 
 
-async def mock_entra_get_organization(_):
-    return [
-        Organization(
-            id="org1",
-            name="Organization 1",
-            on_premises_sync_enabled=True,
-        )
-    ]
-
-
 async def mock_entra_get_conditional_access_policies(_):
     return {
         "id-1": ConditionalAccessPolicy(
@@ -61,6 +52,7 @@ async def mock_entra_get_conditional_access_policies(_):
                 application_conditions=ApplicationsConditions(
                     included_applications=["app-1", "app-2"],
                     excluded_applications=["app-3", "app-4"],
+                    included_user_actions=[UserAction.REGISTER_SECURITY_INFO],
                 ),
                 user_conditions=UsersConditions(
                     included_groups=["group-1", "group-2"],
@@ -117,6 +109,16 @@ async def mock_entra_get_admin_consent_policy(_):
     )
 
 
+async def mock_entra_get_organization(_):
+    return [
+        Organization(
+            id="org1",
+            name="Organization 1",
+            on_premises_sync_enabled=True,
+        )
+    ]
+
+
 class Test_Entra_Service:
     def test_get_client(self):
         admincenter_client = Entra(
@@ -160,6 +162,7 @@ class Test_Entra_Service:
                     application_conditions=ApplicationsConditions(
                         included_applications=["app-1", "app-2"],
                         excluded_applications=["app-3", "app-4"],
+                        included_user_actions=[UserAction.REGISTER_SECURITY_INFO],
                     ),
                     user_conditions=UsersConditions(
                         included_groups=["group-1", "group-2"],