Description:
Ensure that Users can add gallery apps to their Access Panel" setting is set to "No” within your Azure Active Directory user settings so that the administrators can evaluate and integrate first these applications in order for users to see them on their access panels.
Rationale:
Unless Azure Active Directory is running as an identity provider for third-party applications, do not allow users to use their identity outside of your cloud environment. User profiles contain private information such as phone numbers and email addresses which could then be sold off to other third parties without requiring any further consent from the user.
Impact:
It might be an additional request that administrators need to fulfill quite often.
Default Value:
By default, Users can add gallery apps to their Access Panel is set to 'No'.
Audit:
Go to Azure Active Directory
Go to Users
Go to User settings
Click on Manage how end users launch and view their applications
Ensure that Users can add gallery apps to their Access Panel is set to No
Remediation:
Pre-Requisite:
A working Azure AD tenant with at least an Azure AD Premium P1 or trial license enabled.
An account with global administrator privileges.
Implementation:
Go to Azure Active Directory
Go to Users
Go to User settings
Click on Manage how end users launch and view their applications
Set Users can add gallery apps to their Access Panel to No
Backout Plan:
Go to Azure Active Directory
Go to Users
Go to User settings
Click on Manage how end users launch and view their applications
Set Users can add gallery apps to their Access Panel to Yes
Note:
Please note that at this point of time, there is no API/CLI mechanism available to programmatically
conduct security assessment for this recommendation.