mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-10-20 10:24:15 +00:00
Ernest Provo
c172b59834
Audits every Conditional Access policy for references to users, groups, or directory roles that no longer resolve in Microsoft Entra ID. Stale references silently change runtime policy behavior — include* references shrink enforcement scope, exclude* references can alter exemption logic — which is a known root cause of "we thought MFA was required but it wasn't" incidents. The implementation follows the eager-init pattern from #11232: - A new resolver method `_resolve_directory_object_references` runs at service init time after the main `asyncio.gather`, walks every loaded Conditional Access policy, deduplicates identifiers per type, and queries Graph for each one (`/users/{id}`, `/groups/{id}`, `/roleManagement/directory/roleDefinitions/{id}`). Sentinel values (`All`, `None`, `GuestsOrExternalUsers`) are skipped before any Graph call. - Only HTTP 404 responses (or `Request_ResourceNotFound` error code) flag an identifier as deleted. Transient errors (5xx, throttling) are logged and skipped so the check never produces false positives on network blips. - Result is cached on the entra client as `unresolved_directory_object_references: Set[Tuple[str, str]]`, which the new pure-sync check reads to emit findings. - The check runs against all policies regardless of state — disabled-policy references are a misconfiguration that becomes live the moment the policy is re-enabled. Fix #11063