What changed in Microsoft Entra ID STIG V1R2V1R2 changes

Discussion

Attackers that are able to exploit an inactive account can potentially obtain and maintain undetected access to an application. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. Applications need to track periods of user inactivity and disable accounts after 35 days of inactivity. Such a process greatly reduces the risk that accounts will be hijacked, leading to a data compromise. To address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to offload those access control functions and focus on core application features and functionality. This policy does not apply to either emergency accounts or infrequently used accounts. Infrequently used accounts are local login administrator accounts used by system administrators when network or normal logon/access is not available. Emergency accounts are administrator accounts created in response to crisis situations. References: https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.users/get-mguser?view=graph-powershell-1.0 https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0&tabs=http https://learn.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0#properties https://learn.microsoft.com/en-us/graph/api/resources/signinactivity?view=graph-rest-1.0#properties For any PowerShell scripts that are Graph, note that Graph endpoints differ depending on where the tenant is located. - For commercial tenants, graph endpoints are graph.microsoft.com. - For GCC High tenants (IL4), graph endpoints are graph.microsoft.us. - For DODDoW tenants (IL5), graph endpoints are dod-graph.microsoft.us. Satisfies: SRG-APP-000025, SRG-APP-000163

V-270204 in V1R2

Title

Microsoft Entra ID must display the Standard Mandatory DODoW Notice and Consent Banner before granting access to the application.

Check text

Verify Entra ID has been configured to display the DODDoW logon banner when a user logs on. 1. Sign in to the Microsoft Entra admin center as a Global Administrator. 2. Browse to or search "Company Branding". 3. Browse to the "Sign-in form" tab and review the required DODDoW banner text in the "Sign-in page text". Note: This field is limited to 1024 characters. If the DODDoW logon banner text is not present in the "Sign-in page text" field, this is a finding.

Fix text

To create the standard DODDoW banner in Entra ID: 1. Sign in to the Microsoft Entra admin center as a Global Administrator. 2. Browse to or search "Company Branding". 3. Select "Customize" under "Default sign-in experience". 4. Browse to the "Sign-in form" tab and place the required DODDoW banner text in the "Sign-in page text". Note: This field is limited to 1024 characters. 5. Populate all required fields. 6. Click "Review + Create".

Discussion

Display of the DODDoW-approved use notification before granting access to the application ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with DTM-08-060. Use the following verbiage for applications that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't." Satisfies: SRG-APP-000068, SRG-APP-000069, SRG-APP-000070

V-270209 in V1R2

Title

Microsoft Entra ID must enforce a 6180-day maximum password lifetime restriction.

Check text

Verify the Entra ID password expiration time period has been changed to 60180 days. Interview the site Entra ID system administrator and verify the script shown in the Fix has been run. If the Entra ID password expiration time period is not 60180 days or less, this is a finding. Note: It is not possible to view the current value for the password expiration time (the Entra ID default is 90). An administrator can check the maximum password age of their Entra ID tenant by using the Graph PowerShell SDK module and the "Get-MgDomain" command by using the script located here: https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.identity.directorymanagement/get-mgdomain?view=graph-powershell-1.0 Note: For any PowerShell scripts that are Graph, note that Graph endpoints differ depending on where the tenant is located. - For commercial tenants, graph endpoints are graph.microsoft.com. - For GCC High tenants (IL4), graph endpoints are graph.microsoft.us. - For DODDoW tenants (IL5), graph endpoints are dod-graph.microsoft.us.

Fix text

Change the default Entra ID password expiration time period to 60180 days by using the Graph script located here: https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.users/update-mguser Use the "Get-MgDomain" command, and update it to 60180 days using the "Update-MgDomain -DomainId &ltDomainName> -PasswordValidityPeriodInDays 60180" command. Note: For any PowerShell scripts that are Graph, note that Graph endpoints differ depending on where the tenant is located. - For commercial tenants, graph endpoints are graph.microsoft.com. - For GCC High tenants (IL4), graph endpoints are graph.microsoft.us. - For DODDoW tenants (IL5), graph endpoints are dod-graph.microsoft.us.

V-270239 in V1R2