-
Notifications
You must be signed in to change notification settings - Fork 222
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
amended Testing Readme with sections for issue links
- Loading branch information
Showing
3 changed files
with
84 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
12 changes: 12 additions & 0 deletions
12
Testing/docs/SettingUpTenantForTestingAADConditionalAccessPolicies.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| ### Setting up the tenant for testing AAD conditional access policies in the functional test plan | ||
| Numerous test cases in the AAD functional test plan associated with conditional access rely on some dependencies in the tenant that you must setup ahead of time: | ||
|
|
||
| - **Step 1** - Create a conditional access policy in the tenant named **Automated Test 1 - DO NOT MODIFY** and set it up as per the configuration in the screenshot below. Set the policy to **Report-only** (do NOT turn it on). This policy is downloaded from the tenant when the test orchestrator executes and its characteristics are modified in memory (using the test orchestrator's RunCached function) before the provider JSON is sent to the Rego. This CA policy must be configured exactly as shown below in order for the test cases to work correctly. The only purpose of this CA policy is to support the execution of the test plan - the policy serves no purpose to the actual operations of the tenant and hence why it must be set to Report-only. | ||
|
|
||
|  | ||
|
|
||
| - **Step 2** - The following conditional access policies are also required to be created in the tenant and configure as per the respective AAD baseline policy instructions, including setting Enable Policy to **On**. The policy names in the tenant must be configure exactly as described below: | ||
| - MS.AAD.1.1v1 Legacy authentication SHALL be blocked | ||
| - MS.AAD.2.1v1 Users detected as high risk SHALL be blocked | ||
| - MS.AAD.2.3v1 Sign-ins detected as high risk SHALL be blocked | ||
| - MS.AAD.3.2v1 If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users |
69 changes: 69 additions & 0 deletions
69
...docs/SetupFunctionalTestOrchestratorServicePrincipalAndAssociatedPermissions.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| ### Setup the Functional Test Orchestrator service principal and associated permissions | ||
| This section describes how to setup an AAD application in the tenant when you want to run the test orchestrator using a **service principal (non interactive login)**. Setup for user interactive login is documented in a separate section. | ||
|
|
||
| Go to Azure AD > App Registrations and click New registration | ||
|  | ||
|
|
||
| Enter the name "Scuba Functional Test Orchestrator" | ||
| Under Who can use this application or API select Single tenant | ||
| Click Register | ||
|  | ||
|  | ||
|
|
||
| Click on the API permissions page | ||
| Click Add a permission then select Microsoft Graph in the popup page. Note some of the permissions are not Graph so pay attention to special instructions below for those. | ||
|  | ||
|
|
||
| Select Application permissions and then add all of the required permissions in the list below which are required for AAD. Once you have selected all of the permissions, click the Add permissions button. | ||
|
|
||
| #### Microsoft Graph API permissions | ||
| - Directory.Read.All | ||
| - GroupMember.Read.All | ||
| - Organization.Read.All | ||
| - Policy.Read.All | ||
| - RoleManagement.Read.Directory | ||
| - User.Read.All | ||
| - PrivilegedEligibilitySchedule.Read.AzureADGroup | ||
| - PrivilegedAccess.Read.AzureADGroup | ||
| - RoleManagementPolicy.Read.AzureADGroup | ||
|
|
||
| #### Office 365 Exchange Online API permissions (select from APIs my organization users) | ||
| - Exchange.ManageAsApp (so the application can run cmdlets in Exchange Online) | ||
|
|
||
| #### Sharepoint API permissions (select from Microsoft APIs) | ||
|
|
||
| - Sites.FullControl.All (so the application can update Sharepoint settings) | ||
|
|
||
|  | ||
|  | ||
|  | ||
|  | ||
|  | ||
|  | ||
|
|
||
| Click the Grant admin consent button on the API permissions page and click Yes in the popup | ||
|  | ||
|
|
||
| The permissions page should now show that admin consent was granted for each of the permissions | ||
|  | ||
|
|
||
| ### Assigning user roles to the Scuba Functional Test Orchestrator application | ||
| Some of the products also need an AAD user role assigned to the application in order for it to be able to update the tenant settings when executing the functional tests. | ||
|
|
||
| #### Assign the following user roles to the "Scuba Functional Test Orchestrator" application using the AAD role assignments page. Note that these should be active assignments in tenants that include PIM. | ||
|
|
||
| - Exchange Administrator (for EXO and most of the Defender cmdlets except for the compliance ones) | ||
| - Compliance Data Administrator (for Defender since it uses Purview compliance center cmdlets such as Set-DlpCompliancePolicy, Set-DlpComplianceRule, Set-ProtectionAlert) | ||
| - Teams Administrator | ||
|
|
||
| Here is an example screenshot that shows the service principal assigned to the Exchange Administrator role | ||
|
|
||
|  | ||
|
|
||
| To complete the setup for PowerPlatform you must also execute the code below to register the service principal with Power Platform: | ||
|
|
||
| ``` | ||
| Add-PowerAppsAccount -Endpoint prod -TenantID $tenantId # use -Endpoint usgov for gcc tenants | ||
| New-PowerAppManagementApp -ApplicationId $appId | ||
| ``` |