Skip to content

Commit 330c419

Browse files
du-dhartleydu-dhartley
authored
Merge pull request #232 from egrayy/feature/ejgray-e8-priv-control
feat(engine): add Essential Eight Restrict Admin Privileges control (E8_PRIV_01)
2 parents 29d5605 + 2d975bc commit 330c419

3 files changed

Lines changed: 210 additions & 0 deletions

File tree

‎engine/policies/essential-eight/asd-essential-eight/v2025/e8_priv_1_1_restrict_admin_privileges.rego‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
# METADATA
2+
# title: Essential Eight - Privileged access restricted and appropriately assigned
3+
# description: |
4+
# Checks whether administrative privileges are limited to an appropriate set
5+
# of users by evaluating Entra ID directory role assignments.
6+
# Assesses two dimensions: whether all privileged accounts are cloud-only,
7+
# and whether the number of privileged users is within an appropriate threshold.
8+
# Research reference: 26T1-SEC-EG-002, 26T1-SEC-EG-004
9+
# custom:
10+
# control_id: E8-PRIV-1.1
11+
# framework: essential-eight
12+
# benchmark: asd-essential-eight
13+
# version: v2025
14+
# severity: critical
15+
# service: EntraID
16+
# requires_permissions:
17+
# - RoleManagement.Read.Directory
18+
# - User.Read.All
19+
20+
package essential_eight.asd_essential_eight.v2025.control_e8_priv_1_1
21+
22+
import rego.v1
23+
24+
MAX_ADMIN_ACCOUNTS := 5
25+
26+
synced_accounts := [a |
27+
some a in input.admin_accounts
28+
a.on_premises_sync_enabled == true
29+
]
30+
31+
is_compliant := false if {
32+
input.total_admin_accounts == 0
33+
}
34+
35+
is_compliant := true if {
36+
input.total_admin_accounts > 0
37+
count(synced_accounts) == 0
38+
input.total_admin_accounts <= MAX_ADMIN_ACCOUNTS
39+
}
40+
41+
is_compliant := false if {
42+
input.total_admin_accounts > 0
43+
count(synced_accounts) > 0
44+
}
45+
46+
is_compliant := false if {
47+
input.total_admin_accounts > MAX_ADMIN_ACCOUNTS
48+
}
49+
50+
default is_compliant := false
51+
52+
result := {
53+
"compliant": is_compliant,
54+
"message": message,
55+
"details": {
56+
"total_admin_accounts": input.total_admin_accounts,
57+
"cloud_only_admin_count": input.cloud_only_admin_count,
58+
"synced_admin_count": input.synced_admin_count,
59+
"synced_accounts": [a.userPrincipalName | some a in synced_accounts],
60+
"threshold": MAX_ADMIN_ACCOUNTS,
61+
"threshold_exceeded": input.total_admin_accounts > MAX_ADMIN_ACCOUNTS,
62+
},
63+
}
64+
65+
message := "No admin accounts detected - check collector permissions" if {
66+
input.total_admin_accounts == 0
67+
}
68+
69+
message := sprintf(
70+
"Privileged access appears appropriately restricted: %d admin account(s) found, all cloud-only",
71+
[input.total_admin_accounts],
72+
) if {
73+
input.total_admin_accounts > 0
74+
is_compliant == true
75+
}
76+
77+
message := sprintf(
78+
"%d privileged account(s) are synced from on-premises Active Directory and not cloud-only",
79+
[count(synced_accounts)],
80+
) if {
81+
input.total_admin_accounts > 0
82+
count(synced_accounts) > 0
83+
}
84+
85+
message := sprintf(
86+
"Privileged access appears excessive: %d admin account(s) found, exceeding the threshold of %d",
87+
[input.total_admin_accounts, MAX_ADMIN_ACCOUNTS],
88+
) if {
89+
input.total_admin_accounts > 0
90+
count(synced_accounts) == 0
91+
input.total_admin_accounts > MAX_ADMIN_ACCOUNTS
92+
}
93+
94+
default message := "Unable to evaluate privileged access: no admin account data available"

‎engine/policies/essential-eight/asd-essential-eight/v2025/metadata.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,24 @@
220220
"RoleManagement.Read.Directory"
221221
],
222222
"notes": "Research basis: 26T1-SEC-EG-001 and 26T1-SEC-EG-003."
223+
},
224+
{
225+
"control_id": "E8-PRIV-1.1",
226+
"title": "Privileged access restricted and appropriately assigned",
227+
"description": "Checks whether administrative privileges are limited to an appropriate set of users by evaluating Entra ID directory role assignments.",
228+
"severity": "critical",
229+
"service": "EntraID",
230+
"maturity_level": "ML1",
231+
"is_manual": false,
232+
"benchmark_audit_type": "Automated",
233+
"automation_status": "ready",
234+
"data_collector_id": "entra.roles.cloud_only_admins",
235+
"policy_file": "e8_priv_1_1_restrict_admin_privileges.rego",
236+
"requires_permissions": [
237+
"RoleManagement.Read.Directory",
238+
"User.Read.All"
239+
],
240+
"notes": "Research basis: 26T1-SEC-EG-002 and 26T1-SEC-EG-004."
223241
}
224242
]
225243
}

‎engine/tests/test_e8_priv_1_1_restrict_admin_privileges.rego‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
package essential_eight.asd_essential_eight.v2025.test_e8_priv_1_1
2+
3+
import rego.v1
4+
5+
test_compliant_cloud_only_within_threshold if {
6+
result := data.essential_eight.asd_essential_eight.v2025.control_e8_priv_1_1.result with input as {
7+
"admin_accounts": [
8+
{"id": "u1", "userPrincipalName": "admin1@contoso.com", "displayName": "Admin One", "on_premises_sync_enabled": false, "admin_roles": ["Global Administrator"]},
9+
{"id": "u2", "userPrincipalName": "admin2@contoso.com", "displayName": "Admin Two", "on_premises_sync_enabled": false, "admin_roles": ["Security Administrator"]},
10+
],
11+
"total_admin_accounts": 2,
12+
"cloud_only_admin_count": 2,
13+
"synced_admin_count": 0,
14+
}
15+
result.compliant == true
16+
result.details.synced_admin_count == 0
17+
result.details.threshold_exceeded == false
18+
}
19+
20+
test_non_compliant_zero_admin_accounts if {
21+
result := data.essential_eight.asd_essential_eight.v2025.control_e8_priv_1_1.result with input as {
22+
"admin_accounts": [],
23+
"total_admin_accounts": 0,
24+
"cloud_only_admin_count": 0,
25+
"synced_admin_count": 0,
26+
}
27+
result.compliant == false
28+
result.message == "No admin accounts detected - check collector permissions"
29+
}
30+
31+
test_non_compliant_synced_account if {
32+
result := data.essential_eight.asd_essential_eight.v2025.control_e8_priv_1_1.result with input as {
33+
"admin_accounts": [
34+
{"id": "u1", "userPrincipalName": "admin1@contoso.com", "displayName": "Admin One", "on_premises_sync_enabled": false, "admin_roles": ["Global Administrator"]},
35+
{"id": "u2", "userPrincipalName": "synced@contoso.com", "displayName": "Synced Admin", "on_premises_sync_enabled": true, "admin_roles": ["Exchange Administrator"]},
36+
],
37+
"total_admin_accounts": 2,
38+
"cloud_only_admin_count": 1,
39+
"synced_admin_count": 1,
40+
}
41+
result.compliant == false
42+
result.details.synced_admin_count == 1
43+
"synced@contoso.com" in result.details.synced_accounts
44+
}
45+
46+
test_non_compliant_threshold_exceeded if {
47+
result := data.essential_eight.asd_essential_eight.v2025.control_e8_priv_1_1.result with input as {
48+
"admin_accounts": [
49+
{"id": "u1", "userPrincipalName": "a1@contoso.com", "displayName": "Admin 1", "on_premises_sync_enabled": false, "admin_roles": ["Global Administrator"]},
50+
{"id": "u2", "userPrincipalName": "a2@contoso.com", "displayName": "Admin 2", "on_premises_sync_enabled": false, "admin_roles": ["Security Administrator"]},
51+
{"id": "u3", "userPrincipalName": "a3@contoso.com", "displayName": "Admin 3", "on_premises_sync_enabled": false, "admin_roles": ["Exchange Administrator"]},
52+
{"id": "u4", "userPrincipalName": "a4@contoso.com", "displayName": "Admin 4", "on_premises_sync_enabled": false, "admin_roles": ["SharePoint Administrator"]},
53+
{"id": "u5", "userPrincipalName": "a5@contoso.com", "displayName": "Admin 5", "on_premises_sync_enabled": false, "admin_roles": ["User Administrator"]},
54+
{"id": "u6", "userPrincipalName": "a6@contoso.com", "displayName": "Admin 6", "on_premises_sync_enabled": false, "admin_roles": ["Compliance Administrator"]},
55+
],
56+
"total_admin_accounts": 6,
57+
"cloud_only_admin_count": 6,
58+
"synced_admin_count": 0,
59+
}
60+
result.compliant == false
61+
result.details.threshold_exceeded == true
62+
}
63+
64+
test_compliant_at_threshold if {
65+
result := data.essential_eight.asd_essential_eight.v2025.control_e8_priv_1_1.result with input as {
66+
"admin_accounts": [
67+
{"id": "u1", "userPrincipalName": "a1@contoso.com", "displayName": "Admin 1", "on_premises_sync_enabled": false, "admin_roles": ["Global Administrator"]},
68+
{"id": "u2", "userPrincipalName": "a2@contoso.com", "displayName": "Admin 2", "on_premises_sync_enabled": false, "admin_roles": ["Security Administrator"]},
69+
{"id": "u3", "userPrincipalName": "a3@contoso.com", "displayName": "Admin 3", "on_premises_sync_enabled": false, "admin_roles": ["Exchange Administrator"]},
70+
{"id": "u4", "userPrincipalName": "a4@contoso.com", "displayName": "Admin 4", "on_premises_sync_enabled": false, "admin_roles": ["SharePoint Administrator"]},
71+
{"id": "u5", "userPrincipalName": "a5@contoso.com", "displayName": "Admin 5", "on_premises_sync_enabled": false, "admin_roles": ["User Administrator"]},
72+
],
73+
"total_admin_accounts": 5,
74+
"cloud_only_admin_count": 5,
75+
"synced_admin_count": 0,
76+
}
77+
result.compliant == true
78+
result.details.threshold_exceeded == false
79+
}
80+
81+
test_result_details_structure if {
82+
result := data.essential_eight.asd_essential_eight.v2025.control_e8_priv_1_1.result with input as {
83+
"admin_accounts": [
84+
{"id": "u1", "userPrincipalName": "admin@contoso.com", "displayName": "Admin", "on_premises_sync_enabled": false, "admin_roles": ["Global Administrator"]},
85+
],
86+
"total_admin_accounts": 1,
87+
"cloud_only_admin_count": 1,
88+
"synced_admin_count": 0,
89+
}
90+
_ = result.compliant
91+
_ = result.message
92+
_ = result.details.total_admin_accounts
93+
_ = result.details.cloud_only_admin_count
94+
_ = result.details.synced_admin_count
95+
_ = result.details.synced_accounts
96+
_ = result.details.threshold
97+
_ = result.details.threshold_exceeded
98+
}

0 commit comments

Comments
 (0)