feat(data): adopt role-tiers.json + tier0-permissions.json (refs #388)#414
Open
Daren9m wants to merge 1 commit into
Open
feat(data): adopt role-tiers.json + tier0-permissions.json (refs #388)#414Daren9m wants to merge 1 commit into
Daren9m wants to merge 1 commit into
Conversation
Adopt two canonical privileged-access reference files from M365-Assess so PIM and service-principal privilege detection share one source of truth instead of per-repo copies: - data/role-tiers.json (+ schema + test): Entra role tier classification (Microsoft Enterprise Access Model) - Tier 0 control plane (4 roles) + Tier 1 management plane (16) - data/tier0-permissions.json (+ schema + test): 41 Graph app permissions with documented attack paths to Global Admin + 8 Tier-1 high-impact data-access permissions (source: github.com/emiliensocchi/azure-tiering, MIT) - REFERENCES.md: canonical reference data rows Data adopted verbatim ($schema repointed to the CheckID schemas). 392 Pester tests pass. Advances #388 (canonical reference data layer; transport-rule-actions + pp-connectors and the unified {id,displayName,classification,...} shape remain).
Daren9m
added this to the
v3.5.0 — Cross-Cutting Reconciliation & Canonical Data Layer milestone
Content enrichment populationOverall (1106 checks): rationale 26.4% (292/1106) • impact 26.4% (292/1106) • references 26.4% (292/1106)
Informational only — does not gate the build. The hard release-gate for Critical/High enrichment lives in #281 (v3.2.0). |
Framework mapping count delta
Result: ✓ PASS — no framework mapping regressions detected. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Per #388 (v3.5 canonical reference data layer), privileged-access lookups that every consumer needs - Entra role tiers (PIM logic, #373) and Tier-0 Graph permissions - should live in CheckID once instead of being re-maintained per repo.
What
Adopts two M365-Assess
controls/files upstream:data/role-tiers.json- Entra ID directory-role tiers (Enterprise Access Model): Tier 0 control plane (4 roles) + Tier 1 management plane (16 roles), keyed by role-template GUID.data/tier0-permissions.json- 41 Microsoft Graph application permissions classified Tier 0, each with a documented attack path to Global Admin, plus 8 Tier-1 high-impact data-access permissions. Source:github.com/emiliensocchi/azure-tiering(MIT).*.schema.json(draft 2020-12) + Pester tests (RoleTiers.Tests.ps1,Tier0Permissions.Tests.ps1): GUID / Graph-permission format, uniqueness, single-tier membership, and registryENTRA-PIM-*consumer presence.REFERENCES.md- canonical reference data rows.Data adopted verbatim; only
$schemarepointed to the CheckID schemas.Testing
Scope
Advances #388 (does not close it): adopts 2 of the 4 proposed reference files;
transport-rule-actions.json+power-platform-connectors.jsonand the unified{id, displayName, classification, source, lastReviewed}shape remain.Notes
main;REFERENCES.mdadds rows to the Canonical Reference Data table - if a sibling adoption PR merged first, resolve the trivial table conflict by keeping all rows.Refs #388, #373