Ensure That Azure Active Directory Admin Is Configured

Using Console

To remediate the misconfiguration of not having Azure Active Directory (AD) Admin configured, you can follow these steps:

Log in to the Azure portal (https://portal.azure.com) using your credentials.
In the left-hand menu, click on “Azure Active Directory”.
Click on “Properties” under the “Manage” section in the left-hand menu.
Scroll down to the “Azure AD admin” section.
Click on “Set Azure AD admin” button.
In the “Set administrator” pane, select the user or group that you want to designate as the Azure AD admin.
Click on the “Select” button.
Click on the “Save” button to save the changes.

Once you have completed the above steps, the Azure AD admin will be configured, and you will have successfully remediated the misconfiguration.

Using CLI

To remediate the misconfiguration “Ensure That Azure Active Directory Admin Is Configured” for AZURE using AZURE CLI, follow the below steps:

Open the AZURE CLI and login to your Azure account using the command:
az login
Once you are logged in, set your subscription using the command:
az account set --subscription <subscription-id>
Replace <subscription-id> with the ID of your Azure subscription.
Next, use the following command to set the Azure Active Directory (Azure AD) admin for your subscription:
az ad sp create-for-rbac --role="Owner" --scopes="/subscriptions/<subscription-id>"
Replace <subscription-id> with the ID of your Azure subscription.
This command will create a new Azure AD application and assign it the Owner role for your subscription. It will output the following details:
- appId: The Application ID of the newly created Azure AD application.
- displayName: The display name of the Azure AD application.
- password: The password for the Azure AD application. This is the only time the password will be shown, so make sure to save it in a secure location.
- tenant: The ID of the Azure AD tenant associated with the subscription.
Finally, use the following command to assign the newly created Azure AD application as the subscription admin:
az role assignment create --assignee <appId> --role "Owner" --subscription <subscription-id>
Replace <appId> with the Application ID of the newly created Azure AD application, and <subscription-id> with the ID of your Azure subscription.
After running the above command, the Azure AD admin will be configured for your subscription. You can verify this by running the following command:
az account show
This command will display the details of your Azure subscription, including the Azure AD admin.

Using Python

To remediate the misconfiguration “Ensure that Azure Active Directory Admin is configured” in Azure using Python, you can follow the below steps:Step 1: Install the Azure SDK for Python using the pip command:

!pip install azure-mgmt-resource

Step 2: Import the required modules:

from azure.common.credentials import UserPassCredentials
from azure.mgmt.resource import ResourceManagementClient
from azure.mgmt.sql import SqlManagementClient

Step 3: Authenticate and create a client object:

subscription_id = 'your_subscription_id'
username = 'your_username'
password = 'your_password'
credentials = UserPassCredentials(username, password)

resource_client = ResourceManagementClient(credentials, subscription_id)
sql_client = SqlManagementClient(credentials, subscription_id)

Step 4: Get the list of all SQL servers in the subscription:

servers = sql_client.servers.list()

Step 5: For each SQL server, check if the Azure Active Directory Admin is configured:

for server in servers:
    server_name = server.name
    server_resource_group = server.resource_group_name
    server_details = resource_client.resources.get_by_id(
        server.id, 
        api_version='2018-06-01-preview'
    )
    properties = server_details.properties
    if 'administratorLogin' in properties and 'administratorLoginPassword' in properties:
        admin_login = properties['administratorLogin']
        admin_password = properties['administratorLoginPassword']
        aad_admin = sql_client.servers.get_server_auditing_policy(
            server_resource_group, 
            server_name
        ).auditing_policy_details.audit_actions_and_groups.audit_actions.contains('DATABASE_SQL_AUDIT_ACTION_GROUP')
        if not aad_admin:
            sql_client.servers.create_or_update_server_auditing_policy(
                server_resource_group, 
                server_name, 
                {
                    "properties": {
                        "state": "Enabled",
                        "auditActionsAndGroups": {
                            "auditActions": [
                                "DATABASE_SQL_AUDIT_ACTION_GROUP"
                            ]
                        },
                        "storageEndpoint": "https://your_storage_account.blob.core.windows.net",
                        "storageAccountAccessKey": "your_storage_account_access_key",
                        "storageAccountSubscriptionId": "your_storage_account_subscription_id",
                        "retentionDays": 90,
                        "useServerDefault": False
                    }
                }
            )
            print(f"Azure Active Directory Admin is configured for SQL server {server_name}")
    else:
        print(f"Admin login and password not found for SQL server {server_name}")

Note: You will need to replace the placeholders your_subscription_id, your_username, your_password, your_storage_account, your_storage_account_access_key, and your_storage_account_subscription_id with your own values.The above code will enable auditing for the SQL server and ensure that the Azure Active Directory Admin is configured.

Using Terraform

resource "azurerm_mssql_server" "SQL_SERVER" {
  name                         = "SQL_SERVER_NAME"          # replace with your SQL server name
  resource_group_name          = "RESOURCE_GROUP_NAME"      # replace with your resource group
  location                     = "AZURE_REGION"             # e.g. eastus
  version                      = "12.0"
  administrator_login          = "SQL_ADMIN_LOGIN"          # existing SQL admin login
  administrator_login_password = "SQL_ADMIN_PASSWORD"       # existing SQL admin password

  # ...any other existing settings...
}

resource "azurerm_mssql_active_directory_administrator" "SQL_SERVER_AAD_ADMIN" {
  server_id = azurerm_mssql_server.SQL_SERVER.id

  tenant_id      = "AAD_TENANT_ID"          # replace with your Azure AD tenant ID (GUID)
  login          = "AAD_ADMIN_DISPLAY_NAME" # e.g. name of the user/group to act as admin
  object_id      = "AAD_OBJECT_ID"          # object ID of that user/group/service principal
  principal_type = "User"                   # or "Group" / "ServicePrincipal" as appropriate
}

This change does not replace the SQL server; it adds/updates the Azure AD administrator configuration in place.Verification with terraform plan should show creation (or update) of azurerm_mssql_active_directory_administrator.SQL_SERVER_AAD_ADMIN with the specified tenant_id, object_id, login, and principal_type, and no destroy of the existing azurerm_mssql_server.

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

Ensure That Azure Active Directory Admin Is Configured

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: