Bug with MS.DEFENDER.1.4v1 - "Sensitive accounts SHALL be added to Exchange Online Protection in the strict preset security policy." about scubagear HOT 2 CLOSED

Thank you for your report, @sgendron50. Assuming you are using the latest ScubaGear release v1.1.1, note that any of the policies that mentions sensitive accounts requires that those accounts are defined via policy variables in a ScubaGear configuration file for each of the associated policies. So, for example, if you designate the account [email protected] as a sensitive account. Then, for MS.DEFENDER.1.4v1 you would need a configuration file that includes, at a minimum, the following:

defender:
  MS.DEFENDER.1.4v1:
    SensitiveAccounts:
      IncludedUsers:
       - [email protected]

Otherwise, the check will assume the account listed in the policy is not a sensitive account and that sensitive accounts have not been defined, which results in a warning. You can similarly define sensitive groups and domains. For a more complete configuration that sets sensitive users, groups, and domains for each of the sensitive account related policies see the example Defender configuration in https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Sample-Config-Files/defender-config.yaml. Note that you only need the defender section of the configuration example now that ScubaGear supports mixing command line and config file options.
You can then run ScubaGear referencing the config file like so Invoke-Scuba -ConfigFilePath defender-sg-config.yaml -p defender to run using the config and assess just defender.

from scubagear.

You are correct, @schrolla. Closing this issue.

from scubagear.