EIDFED-001: Federated Domain Enumeration
- Platform
- Entra ID / M365
- Category
- Entra ID Federation & Hybrid Identity
- Severity
- Info
- Zero Trust pillar
- Identity (weight 1)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
A complete inventory of all federated domains in the tenant provides visibility into how authentication is configured for each domain. Federated domains redirect authentication to external identity providers, which must be properly secured and monitored. This baseline inventory enables assessment of the federation attack surface and identifies domains that may have been configured by attackers as part of a Golden SAML or backdoor federation attack.
Recommended value
All federated domains inventoried with documented identity provider endpoints, signing certificates, and business justification
Remediation
Enumerate all domains in the tenant using Microsoft Graph and identify those with federation authentication configured. Document the identity provider endpoint, signing certificate details, and federation protocol for each federated domain. Verify that each federation trust is authorized and corresponds to a known, legitimate identity provider under organizational control.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| no-data | Not Assessed |
Framework mappings
- NIST SP 800-53
- CM-8