From 4f3f2e0609613cf41b3da1a55aa9bc26a7b4e08c Mon Sep 17 00:00:00 2001 From: Addam Schroll <108814318+schrolla@users.noreply.github.com> Date: Thu, 23 Jan 2025 10:07:53 -0600 Subject: [PATCH 1/4] Remove outdated reference to README file from AAD header --- PowerShell/ScubaGear/Modules/CreateReport/CreateReport.psm1 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/PowerShell/ScubaGear/Modules/CreateReport/CreateReport.psm1 b/PowerShell/ScubaGear/Modules/CreateReport/CreateReport.psm1 index 06dd3d2e7f..6eeaa3a292 100644 --- a/PowerShell/ScubaGear/Modules/CreateReport/CreateReport.psm1 +++ b/PowerShell/ScubaGear/Modules/CreateReport/CreateReport.psm1 @@ -226,8 +226,8 @@ function New-Report { # Finish building the html report $Title = "$($FullName) Baseline Report" $AADWarning = "Exclusions must only be used if they are approved within an organization's security risk acceptance process. - Please reference this section in the README file - file for a list of the policies that accept exclusions and the instructions for setting up exclusions in the configuration file. + Please reference this section in the product documentation + for a list of the policies that accept exclusions and the instructions for setting up exclusions in the configuration file. Exclusions can introduce grave risks to your system and must be managed carefully." $NoWarning = "
" Add-Type -AssemblyName System.Web From 056b5561e429dbb0a99840429323ac94886ab60e Mon Sep 17 00:00:00 2001 From: Addam Schroll <108814318+schrolla@users.noreply.github.com> Date: Thu, 23 Jan 2025 10:26:55 -0600 Subject: [PATCH 2/4] Add language explaining exclusions in the Entra HTML report header --- PowerShell/ScubaGear/Modules/CreateReport/CreateReport.psm1 | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/PowerShell/ScubaGear/Modules/CreateReport/CreateReport.psm1 b/PowerShell/ScubaGear/Modules/CreateReport/CreateReport.psm1 index 6eeaa3a292..e6c44f1776 100644 --- a/PowerShell/ScubaGear/Modules/CreateReport/CreateReport.psm1 +++ b/PowerShell/ScubaGear/Modules/CreateReport/CreateReport.psm1 @@ -225,8 +225,9 @@ function New-Report { # Finish building the html report $Title = "$($FullName) Baseline Report" - $AADWarning = "Exclusions must only be used if they are approved within an organization's security risk acceptance process. - Please reference this section in the product documentation + $AADWarning = "The ScubaGear configuration file supports exclusions for users, groups, and roles with some policies. + Exclusions must only be used if they are approved within an organization's security risk acceptance process. + See this section in the product documentation for a list of the policies that accept exclusions and the instructions for setting up exclusions in the configuration file. Exclusions can introduce grave risks to your system and must be managed carefully." $NoWarning = "
" From 53f728be48ab739c173f65c265f6b3b1624a49b8 Mon Sep 17 00:00:00 2001 From: Ted Kolovos <107076927+tkol2022@users.noreply.github.com> Date: Fri, 24 Jan 2025 17:52:35 -0500 Subject: [PATCH 3/4] added entra policy 3.7 to the configuration file documentation since it was missing --- docs/configuration/configuration.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/configuration/configuration.md b/docs/configuration/configuration.md index 60593c61ba..8bb94c6ebb 100644 --- a/docs/configuration/configuration.md +++ b/docs/configuration/configuration.md @@ -149,6 +149,7 @@ CapExclusions are supported for the following policies: - MS.AAD.3.1v1 - MS.AAD.3.2v1 - MS.AAD.3.6v1 +- MS.AAD.3.7v1 - MS.AAD.3.8v1 #### Privileged User Policy Exclusions From 2a5c226baa614f8a759f47803696106f4ba52330 Mon Sep 17 00:00:00 2001 From: Ted Kolovos <107076927+tkol2022@users.noreply.github.com> Date: Fri, 24 Jan 2025 17:55:20 -0500 Subject: [PATCH 4/4] slight tweak to the first sentence explaining config file exclusions to align with the prose that is on the respective documentation page. --- PowerShell/ScubaGear/Modules/CreateReport/CreateReport.psm1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/PowerShell/ScubaGear/Modules/CreateReport/CreateReport.psm1 b/PowerShell/ScubaGear/Modules/CreateReport/CreateReport.psm1 index e6c44f1776..460cf272fb 100644 --- a/PowerShell/ScubaGear/Modules/CreateReport/CreateReport.psm1 +++ b/PowerShell/ScubaGear/Modules/CreateReport/CreateReport.psm1 @@ -225,7 +225,7 @@ function New-Report { # Finish building the html report $Title = "$($FullName) Baseline Report" - $AADWarning = "The ScubaGear configuration file supports exclusions for users, groups, and roles with some policies. + $AADWarning = "The ScubaGear configuration file provides the capability to exclude specific users or groups from some of the Entra ID policy checks. Exclusions must only be used if they are approved within an organization's security risk acceptance process. See this section in the product documentation for a list of the policies that accept exclusions and the instructions for setting up exclusions in the configuration file.