EIDGOV-003: Access-package assignments are time-bound
- Plataforma
- Entra ID / M365
- Categoría
- Entitlement Management
- Severidad
- Low
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
An access-package assignment policy configured with no expiration grants perpetual access — the opposite of just-in-time. Time-bounding assignments forces re-request and re-approval, limiting how long any grant survives unreviewed. This check flags assignment policies whose expiration is set to never.
Valor recomendado
Access-package assignment policies expire assignments after a bounded period rather than granting perpetual access
Remediación
In each assignment policy's lifecycle settings, set an assignment expiration (a number of days or a fixed end date) instead of 'Assignments never expire'. Users re-request through the access-package flow when they still need the access, keeping grants deliberate.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| not-assessed | Not Assessed |
| warn | WARN |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-2, AC-2(3)
- CIS M365 Benchmark
- 1.1.1