💡 Summary

Based on issue #887 we are going to add a list of service principals and their assigned highly privileged roles to the AAD report.

Motivation and context

The purpose of this information is to inform CISA about the current state of service principals in agency tenants and specifically which highly privileged roles they possess. Based on the information gathered, the Scuba AAD baseline may be augmented in the future with new policies targeting service principals.

Implementation notes

• Create a new hashtable in the provider JSON named privileged_service_principals. This is very similar to the existing privileged_users table. It will contain a list of the service principals and their respective highly privileged roles. Only service principals with highly privileged roles are to be included. Reference Add service principals to the evaluation scope of AAD ScubaGear policy checks 7.1 through 7.5 #887 for coding guidance since it contains the APIs needed.
• Display this new hashtable in the AAD HTML report at the bottom after the conditional access table
• Test against all tenant types
• Update the unit tests
• Update the functional tests