Add tests for privileged users linked to identities

[Cloud-Architekt]

Enhance the UnifiedIdentityInfo to support linkable identifiers between privileged/regular user accounts and checks to ensure they are linked to their primary identities. This new tests aims to improve security by verifying that enabled privileged accounts do not remain active when their associated primary accounts are disabled, thereby reducing the risk of orphaned accounts. Additionally, it establishes a clear linkage between privileged and regular user accounts for better visibility and incident response.

Contribution Checklist

Before submitting this PR, please confirm you have completed the following:

• 📖 Read the guidelines for contributing to this repository.
• 🧪 Ensure the build and unit tests pass by running /powershell/tests/pester.ps1 on your local system.

 

Join us at the Maester repository discussions 💬 or Entra Discord 🧑‍💻 for more help and conversations!

[cloudflare-workers-and-pages]

Deploying maester with    Cloudflare Pages

Latest commit:	58604cd
Status:	✅  Deploy successful!
Preview URL:	https://cee15025.maester.pages.dev
Branch Preview URL:	https://tnh-privilegeduserlinkediden.maester.pages.dev

View logs

[SamErde]

Does this require the new [preview] identity linking feature or does it also work with account correlation in IDG?

[SamErde]

Does this effectively check all license requirements (and potentially feature activation in the tenant) so it can fail/skip gracefully?

[Cloud-Architekt]

Does this effectively check all license requirements (and potentially feature activation in the tenant) so it can fail/skip gracefully?

Yes, the license check is integrated for all Exposure Management checks. There's only a dependency to the XDR license.
The feature will be available by default. I'm not aware of any preview or feature flag for this functionality.

[Cloud-Architekt]

Does this require the new [preview] identity linking feature or does it also work with account correlation in IDG?

Yes, it's require the new identity linking feature in XDR. Which particular account correlation feature did you mean in IDG (= Identity Governance?)?

[SamErde]

Does this require the new [preview] identity linking feature or does it also work with account correlation in IDG?

Yes, it's require the new identity linking feature in XDR. Which particular account correlation feature did you mean in IDG (= Identity Governance?)?

I did some more digging on that and (according to Copilot) the identity correlation feature in Identity Governance was removed.

[Cloud-Architekt]

@SamErde : Do you have any tenant in Access that can be used for QA of this Maester check?

[SamErde]

@SamErde : Do you have any tenant in Access that can be used for QA of this Maester check?

I don't have time to go too deep today, but after a quick test, they both look good.

For this test, I added the 'Azure AD Joined Device Local Administrator', 'Cloud Device Administrator', and 'Global Reader' roles to my standard account. My CA (cloud admin) account was linked to my standard user account, which caused the test to fail because it was not linked to an un-privileged account.

I will have to create additional test accounts later this week to validate all relevant scenarios.