All entitlement management policies that apply to External users require approval
Overview
Section titled “Overview”Access package assignment policies that allow external users to request access should require approval. Without an approval gate, external users can self-provision access to organizational resources without oversight. Requiring approval ensures that a designated approver reviews each request, providing an opportunity to validate the requestor’s identity and business justification before granting access.
Remediation
Section titled “Remediation”- Configure approval for access package assignment policies
- Review access package policies for external users
Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | Medium |
| Effort to fix | Medium |
| Impact on users | Medium |
| Pillar | Identity |
| Category | Access control |
| Product | Entra ID |
| Feature | Identity Governance |
| Area | External access and sharing |
| ATT&CK | T1078.004 Cloud Accounts, T1199 Trusted Relationship |
| Licence | P2 |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.