feature: add new collector to compliance engine | priority account protection | CIS 2.4.1 and 2.4.2 - #320
Conversation
Adds collector for CIS Microsoft 365 Foundations Benchmark v6.0.0 controls 2.4.1 (Ensure Priority account protection is enabled and configured) and 2.4.2 (Ensure Priority accounts have 'Strict protection' presets applied). Tested against live test tenant - see sample JSON output in engine/samples - Adds PriorityAccountProtectionDataCollector in exchange/protection/ - Registers collector as exchange.protection.priority_account_protection - Updates metadata.json to include collector ID (automation_status is stil left as not_started as rego policy is still outstanding) - Added sample JSON output in engine/samples/
Removing unnecessary terminal outputs used during initial testing Streamlining documentation and comments to match project conventions
Preview EnvironmentA preview environment can be spun up on demand for this PR.
|
CI: Engine
One or more checks failed. View logs |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3f23d072fd
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| #tenant_settings is required for v6.0.0 control 2.4.1 | ||
| #accounts is required for v6.0.0 control 2.4.2 | ||
| tenant_settings = await client.run_cmdlet("ExchangeOnline", "Get-EmailTenantSettings") | ||
| accounts = await client.run_cmdlet("ExchangeOnline", "Get-User", IsVIP=True) |
There was a problem hiding this comment.
For tenants where VIP accounts exist but the Strict preset is disabled or scoped to different recipients, this collector returns the same evidence as a compliant tenant because it only fetches the VIP users and never collects the Strict Preset Security Policy rules/recipient scope. The benchmark text for 2.4.2 requires confirming the strict preset includes the organization’s priority accounts/groups (docs/engine/Framework/CIS_M365_Benchmarks.json lines 450-456), so a future Rego policy wired to this collector cannot evaluate the control correctly. Please also collect the strict EOP/ATP protection policy rules and their recipient conditions/exceptions.
Useful? React with 👍 / 👎.
1 participant
Summary
Adds collector required for CIS Microsoft 365 Foundations Benchmark v6.0.0 controls 2.4.1 (Ensure Priority account protection is enabled and configured) and 2.4.2 (Ensure Priority accounts have 'Strict protection' presets applied).
Type of Change
Affected Components
/backend-api/frontend/engine(collectors / policies)/security/infrastructure/.github/workflows/docsMotivation
Required to facilitate future 2.4.1 and 2.4.2 rego policy scans.
See planner task 26T2-ENG-JC-001.
Testing Done
Tested against live test tenant using the collector test script - see sample JSON output in engine/samples .
Additionally tested using test_wiring.py script to verify no errors resulting from changes to metadata and registry files.
Security Considerations
No known security impact
Breaking Changes
Rollback Plan
Checklist