What it decides

Rule
ENTRA-AUTH-003
Applies to
entra · authorization-policy
Default severity
medium
Basis
documented-guidance

On what authority

Microsoft's reference for `allowedToReadOtherUsers` says, in the property's own description: "**DO NOT SET THIS VALUE TO `false`**". The emphasis is Microsoft's. The setting looks like data minimisation and is not. Reading other users is what makes an address book resolve, a meeting invitation find a person, a sharing dialogue offer a colleague and a group show its members. Turning it off does not hide the directory from an attacker who has a token; it breaks the products for the people who work there, in ways that surface later as unrelated faults nobody connects back to this. IT IS RECORDED AS GUIDANCE AND NOT AS A REQUIREMENT because the tenant accepts the value and the API allows it. Microsoft states a position in the strongest words it uses; it does not refuse the setting.

What it needs to decide

  • authorization_policy.users_may_read_other_users

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

  • tenant-governance: what every user in a tenant may do without asking, and how many accounts hold the role that may do anything · live-validated

What a pass does not establish

THIS SAYS NOTHING ABOUT WHAT ELSE THE DEFAULT USER ROLE MAY DO. The same permission set decides whether users may register applications, create security groups, create tenants and read their own BitLocker keys. This rule reads one of them.

  • A tenant may have been in this state for a long time without anybody connecting a broken people picker, an empty group membership list or a sharing dialogue that finds nobody to this setting. The finding explains symptoms; it does not prove they are present.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b10@0c269e9d29d0.

Generated from capability-manifest/1.0.0 at 1.0.0b10@0c269e9d29d0, contract 1.0.0b10. Every fact on this page is the Engine's; this site publishes it and does not maintain it.