feat(intune): add device compliance policy marks noncompliant check#10599
Open
HugoPBrito wants to merge 9 commits intomasterfrom
Open
feat(intune): add device compliance policy marks noncompliant check#10599HugoPBrito wants to merge 9 commits intomasterfrom
HugoPBrito wants to merge 9 commits intomasterfrom
Conversation
github-actions
bot
added
provider/m365
Contributor
|
✅ All necessary |
Contributor
|
✅ Conflict Markers Resolved All conflict markers have been successfully resolved in this pull request. |
Contributor
Compliance Mapping ReviewThis PR adds new checks. Please verify that they have been mapped to the relevant compliance framework requirements. New checks already mapped in this PR
Use the |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #10599 +/- ##
==========================================
+ Coverage 85.71% 88.08% +2.36%
==========================================
Files 15 124 +109
Lines 504 5203 +4699
==========================================
+ Hits 432 4583 +4151
- Misses 72 620 +548
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
Contributor
🔒 Container Security ScanImage: 📊 Vulnerability Summary
4 package(s) affected
|
…MT.1054) Implements Prowler check equivalent to Maester test MT.1054. Verifies that the Intune built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant' by checking the secureByDefault setting.
…nt check Covers secure_by_default true/false/None and settings being None. Uses exact string assertions following Prowler test conventions.
HugoPBrito
force-pushed
the
PROWLER-855-mt-1054-intune-compliance-default
branch
from
faba529 to
a39863f
Compare
HugoPBrito
changed the title
HugoPBrito
changed the title
github-actions
bot
added
compliance
…_policy_unassigned_devices_not_compliant_by_default Rename from intune_device_compliance_policy_marks_noncompliant to better reflect the check's purpose: verifying that unassigned devices are marked as not compliant by default. Update metadata, compliance mapping, tests, and changelog accordingly.
…-intune-compliance-default
Replace mock.MagicMock (class) with mock.MagicMock() (instance) and explicitly set verification_error=None to prevent state pollution between tests when pytest runs them in alphabetical order.
HugoPBrito
force-pushed
the
PROWLER-855-mt-1054-intune-compliance-default
branch
from
c2137a3 to
1c9dd87
Compare
Revert intune_service.py and intune_service_test.py to master state (retry logic was not part of this check). Remove unnecessary __init__.py from test directory.
Reverts the accidental removal of intune_service.py retry logic and its corresponding tests in intune_service_test.py.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
This PR adds a native Prowler Intune check to verify that devices without an assigned compliance policy are treated as non-compliant. This helps prevent unmanaged devices from being considered compliant by default and reduces the risk of those devices satisfying compliance-based access controls unexpectedly.
Related issue: https://prowlerpro.atlassian.net/browse/PROWLER-855
Description
intune_device_compliance_policy_marks_noncompliantfor the M365 providerdeviceManagement/settingssecureByDefaultsettingsecure_by_default=True,False,None, and missing settings4.1prowler/CHANGELOG.mdSteps to review
prowler/providers/m365/services/intune/intune_device_compliance_policy_marks_noncompliant/prowler/compliance/m365/cis_6.0_m365.jsonprowler/CHANGELOG.mdChecklist
Community Checklist
SDK/CLI
License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.