iCompaas Support

Description:

In Azure Active Directory (Azure AD), all users are granted a set of default permissions. A user’s access consists of the type of user, their role assignments, and their ownership of individual objects. Restrict access to the Azure AD administrative portal. Setting this option to Yes restricts all non-administrators from accessing any Azure AD data in the administration portal.

Rationale:

The Azure AD administrative portal has sensitive data. All non-administrators should be prohibited from accessing any Azure AD data in the administration portal to avoid exposure.

Impact:

By restricting access from the Azure AD administrative portal to the non-admin users, the exposure to sensitive information in the portal is reduced, and this improves the resiliency of the Azure AD portal.

Default Value:

By default, Restrict access to Azure AD administration portal is set to No.

Pre-requisites:

• Microsoft Entra ID (Azure AD) tenant access

• One of the roles is Global Administrator/Privileged Role Administrator

Test Plan:

1. Sign in to the Azure portal at https://portal.azure.com and navigate to Microsoft Entra ID (Azure AD).

2. Under Manage, select User settings.

3. Locate, restrict access to the Microsoft Entra admin center, and verify that the setting is set to Yes.

   4. If this value is set to NO, follow the remediation below to fix it.

Implementation Steps:

1. Sign in to the Azure portal at https://portal.azure.com and navigate to Microsoft Entra ID (Azure AD).

2. Under Manage, select User settings from the left pane.

3. In the Administration center, locate Restrict access to the Microsoft Entra admin center and set the value to Yes.

4. Click Save to apply the configuration.

 Backout Plan:

1. Sign in to the Azure portal and navigate to Microsoft Entra ID (Azure AD).

2. Under Manage, select User settings.

3. In the Administration center, locate Restrict access to the Microsoft Entra admin center and set the value to No.

4. Click Save to apply the changes.

Reference:

• https://docs.microsoft.com/en-us/azure/active-directory/active-directory-assign- admin-roles-azure-portal

• https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls- v2-governance-strategy#gs-2-define-enterprise-segmentation-strategy

• https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-6-define-identity-and-privileged-access-strategy

• https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls- v2-privileged-access#pa-1-protect-and-limit-highly-privileged-users

• https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-privileged-access#pa-2-restrict-administrative-access-to-business-critical- systems