Entra ID CIS Assessment with SmartProfiler-SecID

• Nirmal@DynamicPacks.net
• November 8, 2024
• No Comments

About SmartProfiler

SmartProfiler for Entra ID is designed to mitigate security risks in the Azure Entra by performing an advanced assessment. Executing Entra ID CIS Assessment With SmartProfiler-SecID will ensure that your Entra ID environment is configured with recommended settings to avoid security risks. Whereas SmartProfiler for AVD Assessment is designed to find bottlenecks/issues in the existing AVD environment and help in finding the missing settings recommended by Microsoft for improving the performance of the AVD environment. AVD Assessment can also check if the configuration is consistent across the host pools.

Entra ID CIS Assessment with SmartProfiler-SecID – Entra ID Assessment Requirements

ENTRA ID Assessment supports only STORED-CRED connection method.

STORED-CRED

• In STORED-CRED connection method, you create a Custom Entra App and apply those required Application Permissions.
• Here Connect-MGGraph will connect to Custom Entra App.
  • In this case, Built-In Microsoft Graph PowerShell will not be touched.
• The Advantage here is that you can run unattended assessment and also use “Health Check” and “Assessment Scheduler” for ENTRA ID.

Executing Assessment using STORED-CRED Connection Method

The STORED-CRED Connection method can be used if you:

• Plan to execute Unattended Assessment – You will not be prompted to enter credentials.
• Plan to use Health Monitoring feature of SmartProfiler-SecID for Entra ID Tenants
• Plan to use ENTRA ID Assessment Scheduler.

Note that you will still be required to use a Global Admin or Global Reader account if you plan to use STORED-CRED option and Global Reader or Admin account must be a non-MFA account.

To use the STORED-CRED option you are required to create an Entra App and assign the following permissions to the Entra App:

• Directory.Read.All
• IdentityProvider.Read.All
• OnPremDirectorySynchronization.Read.All
• Policy.Read.All
• RoleManagement.Read.All
• User.Read.All
• UserAuthenticationMethod.Read.All
• RoleAssignmentSchedule.Read.Directory

And “Reader” IAM role has been assigned to Entra App to the subscription.

Once you have met the above requirements, you can proceed with the next steps.

Registering Entra ID Tenant

To register Entra ID Tenant with SmartProfiler-SecID, please expand Tenants and Settings Section in left pane and then click on “Add New Tenant” button as shown below:

Then in the register a new tenant window, select Microsoft Azure Entra ID SP v1.0 in the list of available technologies and provide the Tenant details as below:

SmartProfiler requires the following inputs for ENTRA ID Tenants:

• Azure Tenant ID: Enter the Azure Tenant ID here if you plan to use STORED-CRED option.
• Azure App ID: Enter the Azure App ID here if you plan to use STORED-CRED option.
• Azure App Secret: Please note to enter the Secret you need to enter the secret in box below the grid and then click on Apply button to apply the secret.

• Azure Subscription ID: Enter the Azure Subscription ID here if you plan to use STORED-CRED option.
• Is a GOV Cloud? : Type Yes or No.

If you have purchased ENTRA ID Assessment license, then click on Browse button to apply the license codes from the license file.

Note that the registration process for a Entra ID Tenant will actually check the status of the Entra ID domain entered and global admin account to ensure domain is verified and global admin account has access to the tenant.

Once done, click on “Add Tenant” button to add tenant under the management of SmartProfiler.

Creating an Assessment View

Note that you need to create an assessment view before the assessment can be executed. To create an Assessment View, expand Tenants and Settings section in left pane and then click on “Manage Settings” button:

And then click on “Create View” button. In the Create a New View Window, provide the following inputs:

• View Name: The Assessment View name can be any name that you would like to provide.
• Select Assessment Technology: Select Microsoft Azure Entra ID SP v1.0 in the list of technologies.
• Select Tenant: Select the Tenant that you added recently.
• Select Test Template: Leave it default

Once you have provided details for a new Assessment View, click on “Create View” button to create the view.

Executing ENTRA ID Assessment

Once the Tenant has been registered with SmartProfiler and you have created an Assessment View, you can expand “Assessment Views” section in the left pane to see your view, expand the Assessment View and then click on “Assessment Console” to open the assessment console as shown below:

After clicking on Assessment Console, you will see list of tests available in console.

Start Execution

To start the execution, select the credential from the credential dropdown:

And then click on “Execute Assessment” button to start the ENTRA ID Assessment.

Entra ID CIS Assessment Summary

In the Assessment Summary window, you can see the issues that were detected for Entra ID Tenant and impact and recommendation for each issue. When clicked on “Assessment Summary” button the summary window will populate all issues in each Entra ID Assessment category as shown below:

As you can see from the screenshot above, SmartProfiler has reported high, medium, low and non-compliance issues. It has also reported the items that have been passed successfully. If you need to see data for a test, click on test.

Here are the columns that are displayed as part of the Entra ID Assessment and their meaning:

• No.: Shows test number.
• Category/Test: Show test name that was executed.
• Severity: Shows severity of the test. The severity can be Critical, High, Medium, Low, Passed, Completed, and Not Executed.
• Control: This column shows if the test belongs to CIS Control or not. You will see SmartProfiler Control 1.0 or CIS Control Version 1.5

Note: SmartProfiler for Entra ID includes all CIS Control tests for Entra ID foundation. However, some of the tests have been designed by our Entra ID experts to ensure every aspect of Entra ID Subscription is checked and reported as part of the report.

• CIS Profile: Shows CIS Profile type for CIS Test.
• Compliance: Shows compliance status for the test. The reported data is “Compliant” or “Non-Compliant”.
• Affected Objects: This column shows the number of affected objects for each test. If showed “0 or NA” that means the test doesn’t have affected objects or affected objects is not applicable to the current test.
• Impact: Associated impact text with the test.
• Recommendation: Associated recommendation text with the test.

Generating Report

To generate a report for Entra ID Tenant, click on “Generate Report” item found under Assessment View in left pane

Note that SmartProfiler for Entra ID is capable of generating a Microsoft Word Report and an excel summary which contains the affected objects list for each test.

Click on the Browse button to specify the report location and check/uncheck various other options as explained below:

• Include Reference Link and Default Value: If you check this option, SmartProfiler is going to include reference link for each test and its default values. The option is checked by default.
• Include SmartProfiler Tests: If you would like to include SmartProfiler tests in the report, please check this option.
• Include “Not Executed” and “Passed” tests in same section: If you check this option all not executed and passed items will be executed in the same section of each category. Unchecking this option will instruct reporting process to include all passed and not executed items in a separate section in word document.

Once you have checked/unchecked required options, please click on “Generate Report” button. The process will take some time, and progress will be shown on the screen.

All CIS Tests that are covered by SmartProfiler can be found on CIS website. Note that SmartProfiler supports the latest CIS Version 3.1.0.

Try SmartProfiler, a unified tool to help with security evaluation across many Microsoft technologies.