EIDAPP-016: Managed Identity Inventory and Permissions
- Plataforma
- Entra ID / M365
- Categoría
- Consent
- Severidad
- Info
- Pilar de Zero Trust
- Applications & Workloads (peso 1)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Managed identities provide Azure resources with automatically managed credentials for authenticating to services that support Entra ID authentication. While managed identities eliminate the need for stored credentials, they can still be over-permissioned or assigned to resources that no longer require them. A comprehensive inventory of managed identities and their permission assignments ensures least-privilege access and identifies orphaned identities associated with deleted resources.
Valor recomendado
All managed identities inventoried with documented resource associations and least-privilege permission assignments
Remediación
Enumerate all system-assigned and user-assigned managed identities across Azure subscriptions using Azure Resource Graph or the Azure portal. Review the role assignments and API permissions granted to each managed identity and verify they follow least-privilege principles. Remove role assignments from managed identities associated with deleted or decommissioned resources and document the purpose and permission requirements for each active managed identity.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| no-data | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-8
- CIS Azure
- 8.5