MS.AAD.3.3v1 does not check for the use of Microsoft Authenticator OTPs

[mitchelbaker-cisa]

🐛 Summary

We had a public report of MS.AAD.3.3v1 which led to a review of the MS.AAD3.3v1 output.

Implementation instructions for MS.AAD.3.3v1

Step 3 of the implementation instructions indicates the following:

3. For **Allow use of Microsoft Authenticator OTP** select No.

We don't check in the Rego code if Microsoft Authenticator OTP is disabled.

In the Entra ID portal the respective setting is found by navigating through the following:
Go to Microsoft Entra admin center, click Security > Manage > Authentication methods > click Microsoft Authenticator > Configure tab.

To access this setting in Rego, we can use the existing MSAuth variable then access the setting for Microsoft Authenticator OTP with the following:

# Microsoft misspells OAuth as Oath, keep this in mind when implementing
MAuthOTP := MSAuth.AdditionalProperties.isSoftwareOathEnabled # either true/false

Add the above Rego check to the MSAuthProperlyConfigured variable.

# Returns the MS Authenticator configuration settings
MSAuth := auth_setting if {
    some auth_method in input.authentication_method
    some auth_setting in auth_method.authentication_method_feature_settings

    auth_setting.Id == "MicrosoftAuthenticator"
}

# Returns true if MS Authenticator is configured per the baseline, false if it is not
default MSAuthProperlyConfigured := false
MSAuthProperlyConfigured := true if {
    MSAuth.State == "enabled"
    
    MAuthOTP := MSAuth.AdditionalProperties.isSoftwareOathEnabled # either true/false
    MAuthOTP == false

    ...
}

To reproduce

• Go to Microsoft Entra admin center, click Security > Manage > Authentication methods > click Microsoft Authenticator > Configure tab.
• Set the Microsoft Authenticator OTP slider in Entra ID to true/false.
• Run Invoke-SCuBA and notice no change in the results.
• Open the ScubaResults.json file generated from running Invoke-SCuBA.
• ctrl + f and type "authentication_method". This will take you to the respective settings for Microsoft Authenticator.
• Within the respective object for "Id": "MicrosoftAuthenticator", you'll find "isSoftwareOathEnabled" in the "AdditionalProperties" property.

Expected behavior

The rego should check for the Microsoft authenticator OTP setting.