EIDCA-016: CA Policy Documentation Export
- Plataforma
- Entra ID / M365
- Categoría
- Entra ID Conditional Access
- Severidad
- Info
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
A complete export of all Conditional Access policies should be generated for documentation, disaster recovery, and compliance audit purposes. Without documented policy exports, rebuilding CA policies after a tenant compromise or accidental deletion requires significant effort and may result in security gaps.
Valor recomendado
Full CA policy export generated and stored in a secure, versioned repository updated after each policy change
Remediación
Export all Conditional Access policies using Microsoft Graph API or the Entra admin center and store the output in a secure, version-controlled repository. Establish an automated process to capture policy snapshots on a regular schedule or triggered by policy modifications. Include the export in your tenant disaster recovery plan and validate that policies can be restored from the export.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| no-data | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-2, CM-6