EIDTNT-016: Partner Delegated Admin Grant Hygiene (Long-Lived GDAP)
- Plataforma
- Entra ID / M365
- Categoría
- Entra ID Tenant Configuration
- Severidad
- Medium
- Pilar de Zero Trust
- Governance (peso 2)
- Fixtures de referencia
- 5
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- original
Qué comprueba
A GDAP relationship's duration is its auto-extension window: when it lapses it renews itself for that period without any human review. A long auto-extend (beyond a year) is therefore a standing, self-renewing grant of partner administrative access — the opposite of just-in-time — and is exactly the kind of forgotten relationship that outlives the engagement that created it. This check inspects active delegatedAdminRelationships and warns when any relationship auto-extends beyond 365 days; a relationship whose duration cannot be determined is treated conservatively as long-lived rather than assumed fine. It passes only when all active relationships auto-extend within a year. This is a hygiene/governance signal that complements EIDTNT-015 (which grades the privilege the partner holds); here the concern is how long the grant persists unreviewed.
Valor recomendado
All active GDAP relationships auto-extend within 365 days and are reviewed on each renewal
Remediación
For each active partner delegated admin (GDAP) relationship, set the shortest auto-extension duration that fits the engagement (avoid multi-year standing grants), and schedule a review at each renewal. In the Microsoft 365 admin center under Settings > Partner relationships, confirm each relationship is still required and terminate stale ones. Prefer short, renewable delegations over long-lived auto-extending access so that partner administration is re-authorized deliberately rather than by default.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| long-lived | WARN |
| no-partners | PASS |
| not-assessed | Not Assessed |
| short | PASS |
| unparseable-duration | WARN |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-2, AC-2(3), PS-7, SA-9
- CIS M365 Benchmark
- 1.1.3