Policy: Azure > CIS v5.0 > 5 - Identity Services

This section covers security best practice recommendations for products in the Azure Identity services category.

This includes Microsoft Entra ID (Azure AD), Conditional Access, and identity governance recommendations.

Primary Policy

This policy is used with the following primary policy:

Azure > CIS v5.0

5.04 - Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes'
5.05 - Ensure that 'Number of methods required to reset' is set to '2'
5.06 - Ensure that account 'Lockout Threshold' is less than or equal to '10'
5.07 - Ensure that account 'Lockout duration in seconds' is greater than or equal to '60'
5.08 - Ensure that a 'Custom banned password list' is set to 'Enforce'
5.09 - Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to '0'
5.10 - Ensure that 'Notify users on password resets?' is set to 'Yes'
5.11 - Ensure that 'Notify all admins when other admins reset their password?' is set to 'Yes'
5.12 - Ensure that 'User consent for applications' is set to 'Do not allow user consent'
5.13 - Ensure that 'User consent for applications' is set to 'Allow user consent for apps from verified publishers, for selected permissions'
5.14 - Ensure that 'Users can register applications' is set to 'No'
5.15 - Ensure that 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects'
5.16 - Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'
5.17 - Ensure that 'Restrict access to Microsoft Entra admin center' is set to 'Yes'
5.18 - Ensure that 'Restrict user ability to access groups features in My Groups' is set to 'Yes'
5.19 - Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'
5.20 - Ensure that 'Owners can manage group membership requests in My Groups' is set to 'No'
5.21 - Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'
5.22 - Ensure that 'Require Multifactor Authentication to register or join devices with Microsoft Entra' is set to 'Yes'
5.23 - Ensure That No Custom Subscription Administrator Roles Exist
5.24 - Ensure that a custom role is assigned permissions for administering resource locks
5.25 - Ensure that 'Subscription leaving Microsoft Entra tenant' and 'Subscription entering Microsoft Entra tenant' is set to 'Permit no one'
5.26 - Ensure fewer than 5 users have global administrator assignment
5.27 - Ensure there are between 2 and 3 subscription owners
5.28 - Ensure passwordless authentication methods are considered
5.01 - Security Defaults (Per-User MFA)
5.02 - Conditional Access
5.03 - Periodic Identity Reviews
Maximum Attestation Duration

Controls

Setting this policy configures these controls:

Policy Specification

Schema Type	`string`
Default	`Per Azure > CIS v5.0`
Valid Values [YAML]	`Per Azure > CIS v5.0` `Skip` `Check: All CIS Benchmarks except attestations` `Check: All CIS Benchmarks`
Examples [YAML]	`Skip`

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/cis#/control/categories/cis

Policy Type URI

tmod:@turbot/azure-cisv5-0#/policy/types/s05

GraphQL

query policyType(id: "tmod:@turbot/azure-cisv5-0#/policy/types/s05") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/azure-cisv5-0#/policy/types/s05'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/azure-cisv5-0#/policy/types/s05'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/azure-cisv5-0#/policy/types/s05"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/azure-cisv5-0#/policy/types/s05"