Default Parameters for AzrADDrctryRlTest

In large cloud deployments, it is good practice for administrators to periodically audit the role assignments, so they can spot inconsistencies early. Inadvertent/careless mistakes in role assignments can seriously harm the security and integrity of the Azure cloud organization. For instance, if the critical Security Administrator role is assigned to a user who is ignorant of the security policies in place, it can cause that user to knowingly/unknowingly toggle security flags, which can put the entire cloud organization at risk. To avoid this, administrators are advised to run the AzrADDrctryRlTest at configured intervals!

This test reports the count of AD roles, and the number of roles that are assigned and yet to be assigned to users. Detailed diagnostics (if enabled) reveal what role has been assigned to which member, thus enabling administrators to verify the legitimacy and correctness of the assignments.

This page depicts the default parameters that need to be configured for the AzrADDrctryRlTest.

• The TEST PERIOD list box helps the user to decide how often this test needs to be executed.

• Specify the Directory ID of the Azure AD tenant to which the target subscription belongs in the TENANT ID text box. To know how to determine the Directory ID/Tenant ID Click here.

• The eG agent communicates with the target Microsoft Azure Subscrption using Java API calls. To collect the required metrics, the eG agent requires an Access token in the form of an Application ID and the client secret value.Specify the Application ID of the created Application in the CLIENT ID TEXTBOX To know how to determine the Application ID Click here. Specify the client secret value in the CLIENT PASSWORD text box. To obtain the client secret value Click here.

• In some environments, all communication with the Azure cloud be routed through a proxy server. In such environments, you should make sure that the eG agent connects to the cloud via the proxy server and collects metrics. To enable metrics collection via a proxy, specify the IP address of the proxy server and the port at which the server listens against the PROXY HOST and PROXY PORT parameters. By default, these parameters are set to none , indicating that the eG agent is not configured to communicate via a proxy, by default.

• If the proxy server requires authentication, then, specify a valid proxy user name and password in the PROXY USERNAME and PROXY PASSWORD parameters, respectively. Then, confirm the password by retyping it in the Confirm Password text box.

• By default, SHOW ASSIGNED DIRECTORY DD flag is set to false. This means that, by default, the test will not report detailed diagnostics for the Assigned directory role measure. This default setting ensures that the detailed metrics for the Assigned directory role measure does not hog space in the eG database, where roles are assigned to numerous Azure users.

  If you have a well-tuned and well-sized eG database, then set this flag to true. In this case, the test will collect and store detailed metrics for the Assigned directory role measure.

• The DD FREQUENCY refers to the frequency with which detailed diagnosis measures are to be generated for this test. The default is 1:1. This indicates that, by default, detailed measures will be generated every time this test runs, and also every time the test detects a problem. You can modify this frequency, if you so desire. Also, if you intend to disable the detailed diagnosis capability for this test, you can do so by specifying none against DD FREQUENCY.

• Once the necessary values have been provided, clicking on the UPDATE button will register the changes made.

When changing default configurations of tests, the values with “$” indicate variables that will be replaced by the eG system according to the specific server being managed - for instance, $hostName is the host/nickname of the target host, $port is the port number of the server being monitored. E.g., for a server xyz:80, $hostName will be changed automatically by the eG manager to “xyz*” and $port will be changed to “80” when configuring a test.