Implement enterprise application identity and OAuth security rules

[ritiksah141]

Objective

Implement the Azure Entra application identity and OAuth security rule pack with evidence-backed findings and conservative handling of incomplete Microsoft Graph data.

Scope

Implement these controls:

1. An application has high-risk Microsoft Graph permissions.
2. An application has tenant-wide admin consent without approved justification.
3. An unverified publisher application has privileged permissions.
4. Application credentials have an excessive validity period.
5. An application contains multiple active secrets without documented need.
6. A stale application retains credentials or privileged permissions.
7. A service principal allows access without required user assignment.
8. A federated identity credential uses an overly broad subject or trust condition.
9. An application permits public-client authentication unnecessarily.
10. Application ownership contains inactive, guest, or unsuitable accounts.

Collection architecture

• Microsoft Graph applications and service principals.
• Microsoft Graph owners, directory roles, app-role assignments, delegated permissions, and admin consent.
• Application passwords, certificates, federated identity credentials, publisher verification, and account status.
• Tenant policy and documented exception metadata where required.

Required implementation behavior

• Use paginated collectors and preserve resource identifiers and tenant context.
• Return NOT_APPLICABLE when an application, credential type, or feature is absent.
• Return UNKNOWN for permission failures, API errors, partial inventory, or ambiguous ownership.
• Return FAIL only when unsafe configuration is positively evidenced.
• Never expose secret values.
• Include observed/expected state, evidence source and collection time, remediation, required permissions, severity, confidence, and UNKNOWN reason.

Delivery order

1. Permissions, admin consent, publisher, and user-assignment rules.
2. Credential age, duplicate-secret, stale-application, and ownership rules.
3. Federated credential trust and public-client authentication rules.

Acceptance criteria

• Every rule has collector, evaluator, remediation, documentation, and verified mappings.
• Tests cover compliant, non-compliant, empty, paginated, malformed, stale, missing-owner, duplicate-credential, permission-failure, and API-failure cases.
• No API or authorization error creates a false PASS or FAIL.
• No TBD framework mappings remain.
• Scanner, serialization, compliance scoring, and CI-equivalent tests pass.
• An origin-branch PR references this issue.

[parthrohit22]

Coordination — VM Managed Identity rule now owned here (avoids a standalone duplicate).

The "VM without Managed Identity" rule that was briefly scoped under the standalone #269 has been moved into the enterprise identity work instead of being built as a separate rule. It fits this pack's identity scope and the closed #193 (Managed Identity pack).

If a compute-VM managed-identity check is in scope for the enterprise identity rules, please absorb it here rather than opening a new standalone rule issue. #269 now covers only VM Trusted Launch (a genuinely new rule, no overlap).

[github-actions]

This issue has been inactive for 30 days and will be closed in 7 days unless there is activity.

[safidnadaf]

Still on this, just tied up with #291 review right now. Will pick it back up soon.