Add CIS.M365.5.1.4.6: Ensure users are restricted from recovering BitLocker keys#1950
Conversation
…keys Adds a new CIS Microsoft 365 Foundations Benchmark v6.0.1 test (control 5.1.4.6, L2, E3/E5) that checks the tenant-level authorizationPolicy.defaultUserRolePermissions.allowedToReadBitlockerKeysForOwnedDevice setting is false, so non-admin users can't self-service recover the BitLocker key(s) for devices they own. See https://janbakker.tech/block-users-from-viewing-their-bitlocker-keys/
📝 WalkthroughWalkthroughAdds a CIS 5.1.4.6 test that verifies non-admin users cannot recover BitLocker keys for owned devices, documents remediation, exports the cmdlet, and adds Pester coverage. ChangesBitLocker recovery restriction control
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant TestCmdlet
participant MicrosoftGraph
participant TestResult
TestCmdlet->>MicrosoftGraph: Read authorization policy
MicrosoftGraph-->>TestCmdlet: Return BitLocker recovery setting
TestCmdlet->>TestResult: Add pass, fail, skipped, or error detail
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Up to standards ✅🟢 Issues
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
powershell/public/cis/Test-MtCisEnsureBitlockerKeyRecoveryRestricted.md (1)
22-22: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winSpecify a language for the fenced code block.
To improve syntax highlighting and resolve the
markdownlintwarning, specifypowershellas the language for this code block.♻️ Proposed fix
-``` +```powershell🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@powershell/public/cis/Test-MtCisEnsureBitlockerKeyRecoveryRestricted.md` at line 22, Specify powershell as the language identifier on the fenced code block in Test-MtCisEnsureBitlockerKeyRecoveryRestricted documentation, changing the opening fence to use the powershell annotation while leaving the block content unchanged.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@powershell/public/cis/Test-MtCisEnsureBitlockerKeyRecoveryRestricted.md`:
- Line 22: Specify powershell as the language identifier on the fenced code
block in Test-MtCisEnsureBitlockerKeyRecoveryRestricted documentation, changing
the opening fence to use the powershell annotation while leaving the block
content unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 899b336c-9ac2-4131-ac35-1a57e4623632
📒 Files selected for processing (4)
powershell/Maester.psd1powershell/public/cis/Test-MtCisEnsureBitlockerKeyRecoveryRestricted.mdpowershell/public/cis/Test-MtCisEnsureBitlockerKeyRecoveryRestricted.ps1tests/cis/Test-MtCisEnsureBitlockerKeyRecoveryRestricted.Tests.ps1
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
tests/cis/Test-MtCisEnsureBitLockerKeyRecoveryRestricted.Tests.ps1 (1)
4-8: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winDo not silently pass when the check returns
$null.
Test-MtCisEnsureBitLockerKeyRecoveryRestrictedreturns$nullfor disconnected and error paths, but this test then performs no assertion. That can produce a green test run without evaluating the CIS control. Handle$nullexplicitly as a real Pester skip using the repository’s established mechanism, then assert$truefor non-skipped executions.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/cis/Test-MtCisEnsureBitLockerKeyRecoveryRestricted.Tests.ps1` around lines 4 - 8, Update the test around Test-MtCisEnsureBitLockerKeyRecoveryRestricted to handle a $null result explicitly using the repository’s established Pester skip mechanism. Only skip for the disconnected or error-path null outcome; otherwise assert that the result is $true.powershell/public/cis/Test-MtCisEnsureBitLockerKeyRecoveryRestricted.md (1)
22-29: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winDocument the required administrator role.
Policy.ReadWrite.Authorizationalone is insufficient; the signed-in user must also have a supported Entra role, with Privileged Role Administrator being the least-privileged documented role. (learn.microsoft.com)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@powershell/public/cis/Test-MtCisEnsureBitLockerKeyRecoveryRestricted.md` around lines 22 - 29, Update the documentation around Connect-MgGraph in Test-MtCisEnsureBitLockerKeyRecoveryRestricted to state that, in addition to Policy.ReadWrite.Authorization, the signed-in administrator must hold a supported Entra role; identify Privileged Role Administrator as the least-privileged supported role.
🧹 Nitpick comments (1)
powershell/public/cis/Test-MtCisEnsureBitLockerKeyRecoveryRestricted.md (1)
22-29: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winSerialize the remediation body as JSON.
The Graph PATCH endpoint requires
application/json; make the documentation explicit rather than relying on implicit hashtable serialization. (learn.microsoft.com)Proposed documentation update
-Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy" -Body $params +$body = $params | ConvertTo-Json -Depth 3 +Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy" -Body $body -ContentType "application/json"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@powershell/public/cis/Test-MtCisEnsureBitLockerKeyRecoveryRestricted.md` around lines 22 - 29, Update the remediation example around $params and Invoke-MgGraphRequest to explicitly serialize the hashtable body as JSON before issuing the PATCH request, while preserving the existing authorizationPolicy values and endpoint.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@powershell/public/cis/Test-MtCisEnsureBitLockerKeyRecoveryRestricted.md`:
- Around line 22-29: Update the documentation around Connect-MgGraph in
Test-MtCisEnsureBitLockerKeyRecoveryRestricted to state that, in addition to
Policy.ReadWrite.Authorization, the signed-in administrator must hold a
supported Entra role; identify Privileged Role Administrator as the
least-privileged supported role.
In `@tests/cis/Test-MtCisEnsureBitLockerKeyRecoveryRestricted.Tests.ps1`:
- Around line 4-8: Update the test around
Test-MtCisEnsureBitLockerKeyRecoveryRestricted to handle a $null result
explicitly using the repository’s established Pester skip mechanism. Only skip
for the disconnected or error-path null outcome; otherwise assert that the
result is $true.
---
Nitpick comments:
In `@powershell/public/cis/Test-MtCisEnsureBitLockerKeyRecoveryRestricted.md`:
- Around line 22-29: Update the remediation example around $params and
Invoke-MgGraphRequest to explicitly serialize the hashtable body as JSON before
issuing the PATCH request, while preserving the existing authorizationPolicy
values and endpoint.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 194290b5-09d8-4174-b9dd-88275991efb4
📒 Files selected for processing (4)
powershell/Maester.psd1powershell/public/cis/Test-MtCisEnsureBitLockerKeyRecoveryRestricted.mdpowershell/public/cis/Test-MtCisEnsureBitLockerKeyRecoveryRestricted.ps1tests/cis/Test-MtCisEnsureBitLockerKeyRecoveryRestricted.Tests.ps1
🚧 Files skipped from review as they are similar to previous changes (1)
- powershell/Maester.psd1
merill
left a comment
merill
left a comment
There was a problem hiding this comment.
This looks good. Thanks @BakkerJan !!
2 participants
Summary
Test-MtCisEnsureBitLockerKeyRecoveryRestricted, which checks thatauthorizationPolicy.defaultUserRolePermissions.allowedToReadBitlockerKeysForOwnedDeviceisfalse, so non-admin users can't self-service recover the BitLocker recovery key(s) for devices they own via the My Account portal or the Entra admin center.powershell/public/cis/andtests/cis/, following the existingTest-MtCisEnsureUserConsentToAppsDisallowedpattern (samepolicies/authorizationPolicyresource).Background: https://janbakker.tech/block-users-from-viewing-their-bitlocker-keys/
Test plan
Invoke-ScriptAnalyzeron the new file — no findings./build/Build-LocalMaester.ps1— builds and imports cleanly, new function exported./powershell/tests/pester.ps1— all 6293 QA tests passSummary by CodeRabbit
New Features
Tests