Find the shadow IT in your own identity provider

short · 45 min · Objective 2.1

Task

Discover third-party applications holding delegated access to your tenancy, and write the shared responsibility line for three services you actually use.

Steps

  1. Enumerate every third-party application registration and consent grant in the identity provider via its API, into lab/oauth-grants.csv with header app,scopes,granted_by,tenancy_wide,last_used.
  2. For each, record whether the grant is tenancy-wide or per-user. A tenancy-wide grant made by one individual is the finding to look for.
  3. Extract distinct external destinations from your egress or DNS logs into lab/egress-destinations.csv and classify each as sanctioned, unknown or personal.
  4. For three services -- one IaaS, one PaaS, one SaaS -- write lab/responsibility.csv with header service,model,layer,provider_or_customer covering all eight layers from the lesson.
  5. Write lab/responsibility-note.md naming the three layers that are the customer's at EVERY model, and one control in your lab that currently assumes otherwise.

Verify

awk -F, 'NR>1 {n++} END {print n" grant(s)"}' lab/oauth-grants.csv
awk -F, 'NR>1 && $4=="yes" {n++} END {print n+0" tenancy-wide"}' lab/oauth-grants.csv
awk -F, 'NR>1 {print $3}' lab/egress-destinations.csv | sort | uniq -c
awk -F, 'NR>1 {n++} END {print n" responsibility row(s)"}' lab/responsibility.csv
grep -Eci 'identity|configuration|data' lab/responsibility-note.md

Grants enumerated, destinations classified, 24 responsibility rows (three services x eight layers), and the note naming identity, configuration and data as the rows that never move.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.