Cloud Credentials Rotation - Azure

## **Azure Credentials Rotation Playbook** ### **IAM Remediation** Protect your identity and access management: - **Reset Password**: Resets the user password to halt any unauthorized access. - **Revoke Session**: Terminates current active sessions to ensure the malicious actor is locked out. - **Combo Action**: Resets the password and terminates all active sessions. ### **Service Principal Remediation** Guard your applications: - **Password Regeneration**: Generate a new password for the service principal, making sure the old one becomes obsolete.

Azure Enrichment and Remediation · 14 tasks · 5 inputs · 2 outputs

Inputs

  • IAMRemediationType — The response playbook provides the following remediation actions using MSGraph Users: Reset: By entering "Reset" in the input, the playbook will execute password reset. Revoke: By entering "Revoke" in the input, the playbook will revoke the user's session. ALL: By entering "ALL" in the input, the playbook will execute the reset password and revoke session tasks.
  • appID — This is the unique application (client) ID of the application.
  • objectID — This is the unique ID of the service principal object associated with the application.
  • userID — The user ID or user principal name.
  • identityType — The type of identity involved. Usually mapped to incident field named 'cloudidentitytype'. e.g. IAM,APPLICATION

Outputs

  • MSGraphUser — The Microsoft Graph Users information.
  • MSGraphApplication — The Microsoft Graph Application information.

Commands used

msgraph-apps-service-principal-get msgraph-apps-service-principal-lock-configuration msgraph-apps-service-principal-password-add msgraph-apps-service-principal-unlock-configuration msgraph-user-session-revoke msgraph-user-update

Flowchart

ALL Reset Password Revoke Session IAM SP Start Start Reset password - msgraph-user-update Reset password msgraph-user-update Revoke session - msgraph-user-session-revoke Revoke session msgraph-user-session-revoke IAM Users IAM Users Check remediation type Check remediation type Done Done Service Principals Service Principals Get the service principal - msgraph-apps-service-principal-get Get the service principal msgraph-apps-service-principa... Unlock the service principal configuration - msgraph-apps-service-principal-unlock-configuration Unlock the service princi... msgraph-apps-service-principa... Add new password to the service principal - msgraph-apps-service-principal-password-add Add new password to the s... msgraph-apps-service-principa... Generate password - GeneratePassword Generate password GeneratePassword ALL ALL Check identity type Check identity type Lock the service principal configuration - msgraph-apps-service-principal-lock-configuration Lock the service principa... msgraph-apps-service-principa...