azuread_admin_consent_request_policy table | Azure Active Directory plugin

turbot/azuread

Overview

15Tables

Versions

Mods

GitHub

steampipe plugin install azureadsteampipe plugin install azuread

azuread_admin_consent_request_policy azuread_application azuread_authorization_policy azuread_conditional_access_policy azuread_device azuread_directory_audit_report azuread_directory_role azuread_directory_setting azuread_domain azuread_group azuread_identity_provider azuread_security_defaults_policy azuread_service_principal azuread_sign_in_report azuread_user

An Azure Active Directory Admin Consent Request Policy is a feature within Microsoft Azure that controls the workflow of admin consent requests. It provides a centralized way to manage and review admin consent requests for applications requiring access to data they do not have permissions for. Azure AD admin consent request policy helps you stay informed about the access requests and take appropriate actions when predefined conditions are met.

Table Usage Guide

The azuread_admin_consent_request_policy table provides insights into admin consent request policies within Azure Active Directory. As a security engineer, explore policy-specific details through this table, including policy settings, approval steps, and associated metadata. Utilize it to uncover information about policies, such as those with specific approval steps, the workflow of admin consent requests, and the verification of policy settings.

Examples

Basic info

Explore which Azure Active Directory admin consent request policies are enabled and their respective versions. This is useful for assessing the current status and versioning of your policies.

select
  title,
  is_enabled,
  version
from
  azuread_admin_consent_request_policy;

select
  title,
  is_enabled,
  version
from
  azuread_admin_consent_request_policy;

Determine if the admin consent workflow is active in Azure Active Directory, which is essential for enhancing security by ensuring that admins explicitly approve access requests to specific resources.

select
  title,
  is_enabled,
  version
from
  azuread_admin_consent_request_policy
where
  is_enabled;

select
  title,
  is_enabled,
  version
from
  azuread_admin_consent_request_policy
where
  is_enabled;

Determine the users who have the authority to review new administrative consent requests. This is useful for managing permissions and ensuring only appropriate personnel are able to handle these requests.

select
  p.title,
  p.is_enabled,
  u.display_name as user_display_name,
  u.user_principal_name
from
  azuread_admin_consent_request_policy as p,
  jsonb_array_elements(reviewers) as r
  left join azuread_user as u on split_part(r ->> 'query', '/', 4) = u.id
where
  is_enabled;

Error: SQLite does not support split
or string_to_array functions.

Control examples

Schema for azuread_admin_consent_request_policy

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
is_enabled	boolean	Specifies whether the admin consent request feature is enabled or disabled.
notify_reviewers	boolean	Specifies whether reviewers will receive notifications.
reminders_enabled	boolean	Specifies whether reviewers will receive reminder emails.
request_duration_in_days	bigint	Specifies the duration the request is active before it automatically expires if no decision is applied.
reviewers	jsonb	The list of reviewers for the admin consent.
tenant_id	text	The Azure Tenant ID where the resource is located.
title	text	Title of the resource.
version	bigint	Specifies the version of this policy. When the policy is updated, this version is updated.

Export

This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- azuread

You can pass the configuration to the command with the --config argument:

steampipe_export_azuread --config '<your_config>' azuread_admin_consent_request_policy

Table: azuread_admin_consent_request_policy - Query Azure Active Directory Admin Consent Request Policies using SQL