EIDGOV-002: Access-package assignment policies enforce access reviews
- Plataforma
- Entra ID / M365
- Categoría
- Entitlement Management
- Severidad
- Medium
- Pilar de Zero Trust
- Governance (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
An access-package assignment policy without access reviews grants access that is never periodically re-justified, accumulating standing privilege over time. Entra ID Governance can attach recurring access reviews to each policy so assignees (or their managers) must reconfirm need. This check flags assignment policies whose access-review setting is not enabled.
Valor recomendado
Every access-package assignment policy has recurring access reviews enabled
Remediación
For each access-package assignment policy, enable access reviews under the policy's lifecycle settings: choose a recurrence (for example quarterly), reviewers (self, manager, or a named reviewer), and an auto-remove action for denied or unreviewed assignments so unused access is revoked automatically.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| not-assessed | Not Assessed |
| warn | WARN |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-2(3), AC-6(7), PM-10
- CIS M365 Benchmark
- 1.1.1