EIDGOV-004: External access-package eligibility is controlled
- Plataforma
- Entra ID / M365
- Categoría
- Entitlement Management
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 4
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Entitlement management can extend access packages to users outside the tenant (guests and users from connected organizations). A policy that both allows external targets and does not require approval lets outside users self-provision internal access — a direct external-exposure path. This check FAILs when a policy allows external eligibility without approval, WARNs when external eligibility is approval-gated, and passes when policies are internally scoped.
Valor recomendado
No assignment policy allows external or all-users eligibility without approval; external eligibility is scoped to specific connected organizations and approval-gated
Remediación
For policies whose allowed-target scope includes external or all users, either narrow the scope to specific connected organizations, or require approval (and preferably access reviews) on the policy. Never leave a broadly-scoped external eligibility policy auto-approved.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| external-approved | WARN |
| external-open | FAIL |
| internal | PASS |
| not-assessed | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-2, AC-3, AC-6, SA-9
- CIS M365 Benchmark
- 1.1.1