Revert "refactor: rename entra_policy_ensure_default_user_cannot_create_tenants"

This reverts commit 55a8310334.

prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "azure",
+  "CheckID": "entra_policy_ensure_default_user_cannot_create_tenants",
+  "CheckTitle": "Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes'",
+  "CheckType": [],
+  "ServiceName": "entra",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "#microsoft.graph.authorizationPolicy",
+  "Description": "Require administrators or appropriately delegated users to create new tenants.",
+  "Risk": "It is recommended to only allow an administrator to create new tenants. This prevent users from creating new Azure AD or Azure AD B2C tenants and ensures that only authorized users are able to do so.",
+  "RelatedUrl": "https://learn.microsoft.com/en-us/entra/fundamentals/users-default-permissions",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "1. From Azure Home select the Portal Menu 2. Select Azure Active Directory 3. Select Users 4. Select User settings 5. Set 'Restrict non-admin users from creating' tenants to 'Yes'",
+      "Url": "https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#tenant-creator"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Enforcing this setting will ensure that only authorized users are able to create new tenants."
+}

prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.py

@@ -0,0 +1,33 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.entra.entra_client import entra_client
+
+
+class entra_policy_ensure_default_user_cannot_create_tenants(Check):
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+
+        for tenant_domain, auth_policy in entra_client.authorization_policy.items():
+            report = Check_Report_Azure(metadata=self.metadata(), resource=auth_policy)
+            report.subscription = f"Tenant: {tenant_domain}"
+            report.resource_name = getattr(auth_policy, "name", "Authorization Policy")
+            report.resource_id = getattr(auth_policy, "id", "authorizationPolicy")
+            report.status = "FAIL"
+            report.status_extended = (
+                "Tenants creation is not disabled for non-admin users."
+            )
+
+            if getattr(
+                auth_policy, "default_user_role_permissions", None
+            ) and not getattr(
+                auth_policy.default_user_role_permissions,
+                "allowed_to_create_tenants",
+                True,
+            ):
+                report.status = "PASS"
+                report.status_extended = (
+                    "Tenants creation is disabled for non-admin users."
+                )
+
+            findings.append(report)
+
+        return findings

prowler/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.metadata.json

@@ -1,6 +1,6 @@
 {
   "Provider": "microsoft365",
-  "CheckID": "entra_authpolicy_ensure_default_user_cannot_create_tenants",
+  "CheckID": "entra_policy_ensure_default_user_cannot_create_tenants",
   "CheckTitle": "Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes'",
   "CheckType": [],
   "ServiceName": "entra",

prowler/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.py

@@ -4,7 +4,7 @@ from prowler.lib.check.models import Check, CheckReportMicrosoft365
 from prowler.providers.microsoft365.services.entra.entra_client import entra_client
 
 
-class entra_authpolicy_ensure_default_user_cannot_create_tenants(Check):
+class entra_policy_ensure_default_user_cannot_create_tenants(Check):
     """Check if default users are restricted from creating tenants.
 
     This check verifies whether the authorization policy prevents non-admin users

tests/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants_test.py

@@ -0,0 +1,152 @@
+from unittest import mock
+from uuid import uuid4
+
+from tests.providers.azure.azure_fixtures import DOMAIN, set_mocked_azure_provider
+
+
+class Test_entra_policy_ensure_default_user_cannot_create_tenants:
+    def test_entra_no_tenants(self):
+        entra_client = mock.MagicMock
+        entra_client.authorization_policy = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import (
+                entra_policy_ensure_default_user_cannot_create_tenants,
+            )
+
+            check = entra_policy_ensure_default_user_cannot_create_tenants()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_entra_empty_tenant(self):
+        entra_client = mock.MagicMock
+        entra_client.authorization_policy = {DOMAIN: {}}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import (
+                entra_policy_ensure_default_user_cannot_create_tenants,
+            )
+
+            check = entra_policy_ensure_default_user_cannot_create_tenants()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].subscription == f"Tenant: {DOMAIN}"
+            assert result[0].resource_name == "Authorization Policy"
+            assert result[0].resource_id == "authorizationPolicy"
+            assert (
+                result[0].status_extended
+                == "Tenants creation is not disabled for non-admin users."
+            )
+
+    def test_entra_default_user_role_permissions_not_allowed_to_create_tenants(self):
+        id = str(uuid4())
+        entra_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import (
+                entra_policy_ensure_default_user_cannot_create_tenants,
+            )
+            from prowler.providers.azure.services.entra.entra_service import (
+                AuthorizationPolicy,
+                DefaultUserRolePermissions,
+            )
+
+            entra_client.authorization_policy = {
+                DOMAIN: AuthorizationPolicy(
+                    id=id,
+                    name="Test",
+                    description="Test",
+                    default_user_role_permissions=DefaultUserRolePermissions(
+                        allowed_to_create_tenants=False
+                    ),
+                    guest_invite_settings="everyone",
+                    guest_user_role_id=uuid4(),
+                )
+            }
+
+            check = entra_policy_ensure_default_user_cannot_create_tenants()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "Tenants creation is disabled for non-admin users."
+            )
+            assert result[0].resource_name == "Test"
+            assert result[0].resource_id == id
+            assert result[0].subscription == f"Tenant: {DOMAIN}"
+
+    def test_entra_default_user_role_permissions_allowed_to_create_tenants(self):
+        id = str(uuid4())
+        entra_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import (
+                entra_policy_ensure_default_user_cannot_create_tenants,
+            )
+            from prowler.providers.azure.services.entra.entra_service import (
+                AuthorizationPolicy,
+                DefaultUserRolePermissions,
+            )
+
+            entra_client.authorization_policy = {
+                DOMAIN: AuthorizationPolicy(
+                    id=id,
+                    name="Test",
+                    description="Test",
+                    default_user_role_permissions=DefaultUserRolePermissions(
+                        allowed_to_create_tenants=True
+                    ),
+                    guest_invite_settings="everyone",
+                    guest_user_role_id=uuid4(),
+                )
+            }
+
+            check = entra_policy_ensure_default_user_cannot_create_tenants()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "Tenants creation is not disabled for non-admin users."
+            )
+            assert result[0].resource_name == "Test"
+            assert result[0].resource_id == id
+            assert result[0].subscription == f"Tenant: {DOMAIN}"

tests/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/microsoft365_entra_policy_ensure_default_user_cannot_create_tenants_test.py

@@ -10,7 +10,7 @@ from tests.providers.microsoft365.microsoft365_fixtures import (
 )
 
 
-class Test_entra_authpolicy_ensure_default_user_cannot_create_tenants:
+class Test_entra_policy_ensure_default_user_cannot_create_tenants:
     def test_entra_empty_tenant(self):
         entra_client = mock.MagicMock
         entra_client.authorization_policy = {}
@@ -21,15 +21,15 @@ class Test_entra_authpolicy_ensure_default_user_cannot_create_tenants:
                 return_value=set_mocked_microsoft365_provider(),
             ),
             mock.patch(
-                "prowler.providers.microsoft365.services.entra.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_client",
+                "prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client",
                 new=entra_client,
             ),
         ):
-            from prowler.providers.microsoft365.services.entra.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_authpolicy_ensure_default_user_cannot_create_tenants import (
-                entra_authpolicy_ensure_default_user_cannot_create_tenants,
+            from prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import (
+                entra_policy_ensure_default_user_cannot_create_tenants,
             )
 
-            check = entra_authpolicy_ensure_default_user_cannot_create_tenants()
+            check = entra_policy_ensure_default_user_cannot_create_tenants()
             result = check.execute()
             assert len(result) == 1
             assert result[0].status == "FAIL"
@@ -52,12 +52,12 @@ class Test_entra_authpolicy_ensure_default_user_cannot_create_tenants:
                 return_value=set_mocked_microsoft365_provider(),
             ),
             mock.patch(
-                "prowler.providers.microsoft365.services.entra.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_client",
+                "prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client",
                 new=entra_client,
             ),
         ):
-            from prowler.providers.microsoft365.services.entra.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_authpolicy_ensure_default_user_cannot_create_tenants import (
-                entra_authpolicy_ensure_default_user_cannot_create_tenants,
+            from prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import (
+                entra_policy_ensure_default_user_cannot_create_tenants,
             )
 
             entra_client.authorization_policy = AuthorizationPolicy(
@@ -69,7 +69,7 @@ class Test_entra_authpolicy_ensure_default_user_cannot_create_tenants:
                 ),
             )
 
-            check = entra_authpolicy_ensure_default_user_cannot_create_tenants()
+            check = entra_policy_ensure_default_user_cannot_create_tenants()
             result = check.execute()
             assert len(result) == 1
             assert result[0].status == "FAIL"
@@ -92,12 +92,12 @@ class Test_entra_authpolicy_ensure_default_user_cannot_create_tenants:
                 return_value=set_mocked_microsoft365_provider(),
             ),
             mock.patch(
-                "prowler.providers.microsoft365.services.entra.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_client",
+                "prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client",
                 new=entra_client,
             ),
         ):
-            from prowler.providers.microsoft365.services.entra.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_authpolicy_ensure_default_user_cannot_create_tenants import (
-                entra_authpolicy_ensure_default_user_cannot_create_tenants,
+            from prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import (
+                entra_policy_ensure_default_user_cannot_create_tenants,
             )
 
             entra_client.authorization_policy = AuthorizationPolicy(
@@ -109,7 +109,7 @@ class Test_entra_authpolicy_ensure_default_user_cannot_create_tenants:
                 ),
             )
 
-            check = entra_authpolicy_ensure_default_user_cannot_create_tenants()
+            check = entra_policy_ensure_default_user_cannot_create_tenants()
             result = check.execute()
             assert len(result) == 1
             assert result[0].status == "PASS"