feat(data): adopt canonical microsoft-first-party-appids.json (#361)#412
Merged
Conversation
Ship CheckID's canonical Microsoft first-party AppId + owner-tenant allowlist so consumers stop maintaining drifting per-repo copies. Adopted from M365-Assess controls/microsoft-first-party-appids.json (v1.1.0): 280 AppIds + 4 owner tenants, sourced from Microsoft Learn's Power Platform first-party app list. - data/microsoft-first-party-appids.json (repointed $schema to the CheckID schema) - data/microsoft-first-party-appids.schema.json (draft 2020-12) - tests/MicrosoftFirstPartyAppIds.Tests.ps1 (GUID / uniqueness / consumer-check coverage) - REFERENCES.md: document the canonical-reference-data sync surface Consumed by ENTRA-ENTAPP-020 (foreign-app impersonation). 388 Pester tests pass. Closes #361
Daren9m
added this to the
v3.5.0 — Cross-Cutting Reconciliation & Canonical Data Layer milestone
Framework mapping count delta
Result: ✓ PASS — no framework mapping regressions detected. |
Content enrichment populationOverall (1106 checks): rationale 26.4% (292/1106) • impact 26.4% (292/1106) • references 26.4% (292/1106)
Informational only — does not gate the build. The hard release-gate for Critical/High enrichment lives in #281 (v3.2.0). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Multiple consumers (M365-Assess, Az-Assess, future) each maintained their own ad-hoc allowlist of Microsoft first-party AppIds / owner-tenant GUIDs to exclude legitimate Microsoft service principals from "foreign app impersonating Microsoft" checks. M365-Assess's hard-coded list grew twice in one sprint (M365-Assess#887). Per #361, CheckID should own this as canonical data so consumers reference one source instead of drifting copies.
What
Adopts M365-Assess's
controls/microsoft-first-party-appids.json(v1.1.0) upstream into CheckID:data/microsoft-first-party-appids.json- 280 AppIds + 4 owner tenants, sourced from Microsoft Learn's Power Platform first-party app list.$schemarepointed to the CheckID schema (data otherwise verbatim).data/microsoft-first-party-appids.schema.json- draft 2020-12, validates GUID format, required fields, uniqueness shape.tests/MicrosoftFirstPartyAppIds.Tests.ps1- structure, semver, GUID format, case-insensitive AppId uniqueness, and that the consumer checkENTRA-ENTAPP-020exists inregistry.json.REFERENCES.md- new "Canonical Reference Data" section; consumers fetch this alongsideregistry.json/frameworks/*.json.Testing
Rollout
After this is tagged, M365-Assess flips
ENTRA-ENTAPP-020to read the allowlist from CheckID (via its sync) and drops the hard-coded list. First of the v3.5.0 canonical-reference-data adoptions (role-tiers, tier0-permissions, mitre-technique-map, risk-severity to follow).Closes #361