mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-23 12:31:54 +00:00
chore(m365): deprecate user auth (#8865)
This commit is contained in:
Hugo Pereira Brito
committed by
GitHub
GitHub
parent
1a7f52fc9c
commit
ecf749fce8
@@ -5,17 +5,13 @@ Prowler for Microsoft 365 supports multiple authentication types. Authentication
|
||||
**Prowler App:**
|
||||
|
||||
- [**Service Principal Application**](#service-principal-authentication-recommended) (**Recommended**)
|
||||
- [**Service Principal with User Credentials**](#service-principal-and-user-credentials-authentication) (Being deprecated)
|
||||
- [**Service Principal with User Credentials**](#service-principal-and-user-credentials-authentication) (Deprecated)
|
||||
|
||||
**Prowler CLI:**
|
||||
|
||||
- [**Service Principal Application**](#service-principal-authentication-recommended) (**Recommended**)
|
||||
- [**Service Principal with User Credentials**](#service-principal-and-user-credentials-authentication) (Being deprecated)
|
||||
- [**Interactive browser authentication**](#interactive-browser-authentication)
|
||||
|
||||
???+ warning
|
||||
The Service Principal with User Credentials method will be deprecated in October 2025 when Microsoft enforces MFA in all tenants, which will not allow user authentication without interactive methods.
|
||||
|
||||
## Required Permissions
|
||||
|
||||
To run the full Prowler provider, including PowerShell checks, two types of permission scopes must be set in **Microsoft Entra ID**.
|
||||
@@ -30,7 +26,6 @@ When using service principal authentication, add these **Application Permissions
|
||||
- `Directory.Read.All`: Required for all services.
|
||||
- `Policy.Read.All`: Required for all services.
|
||||
- `SharePointTenantSettings.Read.All`: Required for SharePoint service.
|
||||
- `User.Read` (IMPORTANT: this must be set as **delegated**): Required for the sign-in.
|
||||
|
||||
**External API Permissions:**
|
||||
|
||||
@@ -43,20 +38,6 @@ When using service principal authentication, add these **Application Permissions
|
||||
???+ note
|
||||
This is the **recommended authentication method** because it allows running the full M365 provider including PowerShell checks, providing complete coverage of all available security checks.
|
||||
|
||||
### Service Principal + User Credentials Authentication Permissions
|
||||
|
||||
When using service principal with user credentials authentication, you need **both** sets of permissions:
|
||||
|
||||
**1. Service Principal Application Permissions**:
|
||||
|
||||
- All the Microsoft Graph API permissions listed above are required.
|
||||
- External API permissions listed above are **not needed**.
|
||||
|
||||
**2. User-Level Permissions**: These are set at the `M365_USER` level, so the user used to run Prowler must have one of the following roles:
|
||||
|
||||
- `Global Reader` (recommended): Allows reading all required information.
|
||||
- `Exchange Administrator` and `Teams Administrator`: User needs both roles for the same access as Global Reader.
|
||||
|
||||
### Browser Authentication Permissions
|
||||
|
||||
When using browser authentication, permissions are delegated to the user, so the user must have the appropriate permissions rather than the application.
|
||||
@@ -144,30 +125,6 @@ When using browser authentication, permissions are delegated to the user, so the
|
||||
|
||||
|
||||
|
||||
#### Assign User Roles (For User Authentication)
|
||||
|
||||
When using Service Principal with User Credentials authentication, assign the following roles to the user:
|
||||
|
||||
1. Go to Users > All Users > Click on the email for the user
|
||||
|
||||
|
||||
|
||||
2. Click "Assigned Roles"
|
||||
|
||||
|
||||
|
||||
3. Click "Add assignments", then search and select:
|
||||
|
||||
- `Global Reader` (recommended)
|
||||
- OR `Exchange Administrator` and `Teams Administrator` (both required)
|
||||
|
||||
|
||||
|
||||
4. Click next, assign the role as "Active", and click "Assign"
|
||||
|
||||
|
||||
|
||||
---
|
||||
|
||||
## Service Principal Authentication (Recommended)
|
||||
|
||||
@@ -192,48 +149,6 @@ If the external API permissions described in the mentioned section above are not
|
||||
???+ note
|
||||
In order to scan all the checks from M365 required permissions to the service principal application must be added. Refer to the [PowerShell Module Permissions](#grant-powershell-module-permissions-for-service-principal-authentication) section for more information.
|
||||
|
||||
## Service Principal and User Credentials Authentication
|
||||
|
||||
*Available for both Prowler App and Prowler CLI*
|
||||
|
||||
**Authentication flag for CLI:** `--env-auth`
|
||||
|
||||
???+ warning
|
||||
This method is not recommended and will be deprecated in October 2025. Use the **Service Principal Application** authentication method instead.
|
||||
|
||||
This method builds upon Service Principal authentication by adding User Credentials. Configure the following environment variables: `M365_USER` and `M365_PASSWORD`.
|
||||
|
||||
```console
|
||||
export AZURE_CLIENT_ID="XXXXXXXXX"
|
||||
export AZURE_CLIENT_SECRET="XXXXXXXXX"
|
||||
export AZURE_TENANT_ID="XXXXXXXXX"
|
||||
export M365_USER="your_email@example.com"
|
||||
export M365_PASSWORD="examplepassword"
|
||||
```
|
||||
|
||||
These two new environment variables are **required** in this authentication method to execute the PowerShell modules needed to retrieve information from M365 services. Prowler uses Service Principal authentication to access Microsoft Graph and user credentials to authenticate to Microsoft PowerShell modules.
|
||||
|
||||
- `M365_USER` should be your Microsoft account email using the **assigned domain in the tenant**. This means it must look like `example@YourCompany.onmicrosoft.com` or `example@YourCompany.com`, but it must be the exact domain assigned to that user in the tenant.
|
||||
|
||||
???+ warning
|
||||
Newly created users must sign in with the account first, as Microsoft prompts for password change. Without completing this step, user authentication fails because Microsoft marks the initial password as expired.
|
||||
|
||||
???+ warning
|
||||
The user must not be MFA capable. Microsoft does not allow MFA capable users to authenticate programmatically. See [Microsoft documentation](https://learn.microsoft.com/en-us/entra/identity-platform/scenario-desktop-acquire-token-username-password?tabs=dotnet) for more information.
|
||||
|
||||
???+ warning
|
||||
Using a tenant domain other than the one assigned — even if it belongs to the same tenant — will cause Prowler to fail, as Microsoft authentication will not succeed.
|
||||
|
||||
Ensure the correct domain is used for the authenticating user.
|
||||
|
||||
|
||||
|
||||
- `M365_PASSWORD` must be the user password.
|
||||
|
||||
???+ note
|
||||
Previously an encrypted password was required, but now the user password is accepted directly. Prowler handles the password encryption.
|
||||
|
||||
|
||||
|
||||
## Interactive Browser Authentication
|
||||
|
||||
@@ -471,7 +386,7 @@ The required modules are automatically installed when running Prowler with the `
|
||||
Example command:
|
||||
|
||||
```console
|
||||
python3 prowler-cli.py m365 --verbose --log-level ERROR --env-auth --init-modules
|
||||
python3 prowler-cli.py m365 --verbose --log-level ERROR --sp-env-auth --init-modules
|
||||
```
|
||||
If the modules are already installed, running this command will not cause issues—it will simply verify that the necessary modules are available.
|
||||
|
||||
|
||||
@@ -55,11 +55,6 @@ Configure authentication for Microsoft 365 by following the [Microsoft 365 Authe
|
||||
- Tenant ID
|
||||
- `AZURE_CLIENT_SECRET` from the Service Principal setup
|
||||
|
||||
If using user authentication, also add:
|
||||
|
||||
- `M365_USER` (email using the assigned domain in tenant)
|
||||
- `M365_PASSWORD` (user password)
|
||||
|
||||
|
||||
|
||||
3. Click "Next"
|
||||
@@ -85,7 +80,6 @@ PowerShell 7.4+ is required for comprehensive Microsoft 365 security coverage. I
|
||||
Select an authentication method from the [Microsoft 365 Authentication](authentication.md) guide:
|
||||
|
||||
- **Service Principal Application** (recommended): `--sp-env-auth`
|
||||
- **Service Principal with User Credentials**: `--env-auth`
|
||||
- **Interactive Browser Authentication**: `--browser-auth`
|
||||
|
||||
### Basic Usage
|
||||
|
||||
@@ -194,10 +194,10 @@ If you are adding an **EKS**, **GKE**, **AKS** or external cluster, follow these
|
||||
For M365, you must enter your Domain ID and choose the authentication method you want to use:
|
||||
|
||||
- Service Principal Authentication (Recommended)
|
||||
- User Authentication (only works if the user does not have MFA enabled)
|
||||
- User Authentication (Deprecated)
|
||||
|
||||
???+ note
|
||||
User authentication with M365_USER and M365_PASSWORD is optional and will only work if the account does not enforce MFA.
|
||||
???+ warning
|
||||
User authentication with M365_USER and M365_PASSWORD is deprecated and will be removed.
|
||||
|
||||
For full setup instructions and requirements, check the [Microsoft 365 provider requirements](./microsoft365/getting-started-m365.md).
|
||||
|
||||
|
||||
Reference in New Issue
Block a user