26T2-BE-SS-001 — Intune Settings Catalog collector - #303
Conversation
E8-MAC-2.1 is already handled by the asr_rules collector, so the legacy deviceConfigurations fetch here was redundant, an extra Graph call whose output nothing consumed. Removed it and the device_configurations return keys so this collector is Settings-Catalog-only.
Preview EnvironmentA preview environment can be spun up on demand for this PR.
|
CI: Engine
One or more checks failed. View logs |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 80ecece166
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| "entra.conditional_access.e8_mfa_enforcement": E8MfaEnforcementDataCollector, | ||
| # Devices | ||
| "entra.devices.asr_rules": ASRRulesDataCollector, | ||
| "entra.devices.configuration_policies": ConfigurationPoliciesDataCollector, |
There was a problem hiding this comment.
Registering this collector without referencing its ID from any metadata.json deterministically adds entra.devices.configuration_policies to _ORPHANED; engine/tests/test_wiring.py::test_no_orphaned_collectors then unconditionally fails the wiring suite. The collector also cannot be dispatched because scans obtain collector IDs from control metadata, so either wire the applicable controls in this change or defer registration until that metadata and its policies are ready.
Useful? React with 👍 / 👎.
1 participant
Summary
Adds 'entra.devices.configuration_policies', a collector that reads Intune Settings Catalog policies and their configured setting values via Microsoft Graph ('/beta/deviceManagement/configurationPolicies' + per-policy '/settings'). This is the missing data source for the Essential Eight Macro Settings controls that live in the Settings Catalog (E8-MAC-1.1–1.4, 3.1), building on the single ASR-based check (2.1) already shipped. Scoped to the Settings Catalog only, E8-MAC-2.1 stays with the existing 'asr_rules' collector, and the redundant legacy 'deviceConfigurations' fetch was removed so the two don't overlap.
Type of Change
Affected Components
/backend-api/frontend/engine(collectors / policies)/security/infrastructure/.github/workflows/docsMotivation
AutoAudit can't currently read Intune Settings Catalog data, so the Essential Eight Macro Settings controls beyond the ASR rule have no data source and stay unautomated. This collector provides that source, unlocking E8-MAC-1.1–1.4 and 3.1 for the follow-on Rego work (BE-SS-002 onward).
Testing Done
Ran against a sandbox M365 tenant via 'scripts.test_collector'. Authenticated and completed in ~2.7s, returning a macro Settings Catalog policy with all 7 configured settings across Word/Excel/PowerPoint. Used the output to confirm the real Graph setting IDs, which differed from prior guesses in two ways: (1) VBA-warnings and internet-block IDs are per Office app, not a shared 'office16v2' base; (2) VBA and AMSI values are nested (compliant value sits in 'choiceSettingValue.children[0]', not the top level).
Security Considerations
Requires a new read-only Graph application permission ('DeviceManagementConfiguration.Read.All'). No secrets, credentials, or tokens committed. The collector only reads Intune configuration; no writes, no data exposure, no auth/RBAC changes.
Breaking Changes
No breaking changes
Purely additive, a new collector plus one registry entry. Existing scans and collectors are unaffected.
Yes — describe below:
Rollback Plan
Revert commit is sufficient
No DB migrations. Reverting the commits removes the collector and its registry entry cleanly.
Requires additional steps — describe below:
Checklist
Screenshots