Bug with MS.DEFENDER.1.4v1 - "Sensitive accounts SHALL be added to Exchange Online Protection in the strict preset security policy."

[sgendron50]

🐛 Summary

Control ID MS.DEFENDER.1.4v1 is reporting failure, however, there are accounts added to the Exchange Online Protection in the strict preset security policy.

To reproduce

Steps to reproduce the behavior:

Navigate to Defender --> Email & Collaboration --> Policies & Rules --> Threat Policies --> Preset Security Policies --> Manage Protection Settings under Strict Protection. Add users to Apply Exchange Online Protection.

Expected behavior

Control ID would report Success.

[schrolla]

Thank you for your report, @sgendron50. Assuming you are using the latest ScubaGear release v1.1.1, note that any of the policies that mentions sensitive accounts requires that those accounts are defined via policy variables in a ScubaGear configuration file for each of the associated policies. So, for example, if you designate the account johndoe@example.com as a sensitive account. Then, for MS.DEFENDER.1.4v1 you would need a configuration file that includes, at a minimum, the following:

defender:
  MS.DEFENDER.1.4v1:
    SensitiveAccounts:
      IncludedUsers:
       - johndoe@example.com

Otherwise, the check will assume the account listed in the policy is not a sensitive account and that sensitive accounts have not been defined, which results in a warning. You can similarly define sensitive groups and domains. For a more complete configuration that sets sensitive users, groups, and domains for each of the sensitive account related policies see the example Defender configuration in https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Sample-Config-Files/defender-config.yaml. Note that you only need the defender section of the configuration example now that ScubaGear supports mixing command line and config file options.
You can then run ScubaGear referencing the config file like so Invoke-Scuba -ConfigFilePath defender-sg-config.yaml -p defender to run using the config and assess just defender.

[sgendron50]

You are correct, @schrolla. Closing this issue.