feat: implement enterprise privileged access and identity security rules (AZ-IDN-016-025)

[TFT444]

Summary

Implements GitHub issue #258 — 10 new Azure Identity security rules covering privileged access and identity protection for Microsoft Entra ID.

New Rules:

• AZ-IDN-016 (CRITICAL) Privileged user missing phishing-resistant MFA
• AZ-IDN-017 (HIGH) Global Administrator permanently assigned outside PIM
• AZ-IDN-018 (HIGH) Privileged role assigned outside PIM
• AZ-IDN-019 (HIGH) Stale privileged account retains active access (>90 days)
• AZ-IDN-020 (HIGH) No emergency access / break-glass accounts detected
• AZ-IDN-021 (HIGH) Legacy authentication protocols not blocked by Conditional Access
• AZ-IDN-022 (HIGH) No MFA requirement enforced for Azure Management
• AZ-IDN-023 (MEDIUM) Identity Protection risk policies disabled
• AZ-IDN-024 (MEDIUM) Service principals broadly excluded from MFA enforcement
• AZ-IDN-025 (MEDIUM) Privileged role-assignable group has no owner

Infrastructure Added:

• 5 new Microsoft Graph API collectors in scanner/azure_client.py
• Full MockAzureClient support for all 5 new collectors (fully offline testing)
• 58 new tests in tests/test_rules_identity_priv.py all passing
• 10 remediation playbooks (fix_az_idn_016.sh through fix_az_idn_025.sh)
• Compliance mappings: CIS Azure Benchmark 2.0.0, NIST CSF, ISO 27001, SOC 2
• docs/rules-reference.md entries for all 10 rules

Test Plan

• ruff check all checks passed (0 errors)
• ruff format --check 276 files already formatted
• All 10 playbooks pass bash -n syntax validation
• 58 new rule tests pass (pytest tests/test_rules_identity_priv.py)
• Full test suite: 643 passed, 4 pre-existing failures (unrelated), 0 new failures
• All collectors return None on permission failure (no false findings)

Closes #258

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
pip/azure-mgmt-cosmosdb	10.0.0	Unknown	Unknown
pip/azure-mgmt-redis	14.5.0	🟢 6.9	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 9 Found 22/23 approved changesets -- score normalized to 9 CII-Best-Practices 🟢 5 badge detected: Passing Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Binary-Artifacts 🟢 8 binaries present in source code Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 Fuzzing 🟢 10 project is fuzzed

Scanned Files

• requirements.txt

[Vishnu2707]

@TFT444 - Resolve the conflicts, post which an initial review would be appreciated from @ritiksah141 @parthrohit22.

[TFT444]

@TFT444 - Resolve the conflicts, post which an initial review would be appreciated from @ritiksah141 @parthrohit22.

conflict solved. @ritiksah141 @parthrohit22 have a look please i believe its mergable now. verify it please

[parthrohit22]

The overall direction is useful, but this PR is not merge-ready. Several collectors and rules do not match the Microsoft Graph or Azure SDK contracts, which can cause incorrect findings and silent false negatives.

Blocking issues:

1. PIM detection uses roleAssignmentSchedules but expects Eligible/Active assignment types. Microsoft Graph returns Assigned/Activated; eligible assignments must be collected from roleEligibilitySchedules. AZ-IDN-017 and AZ-IDN-018 will therefore misclassify valid PIM assignments.

2. AZ-IDN-023 calls unsupported Identity Protection policy endpoints. The resulting exception is converted to None, so the rule silently returns no findings.

3. AZ-IDN-024 checks for "All" in excludeServicePrincipals, but Graph represents exclusions as service-principal IDs. The workload identity coverage logic needs to use includeServicePrincipals and actual policy scope.

4. Privileged role assignments can target users, groups, or service principals. The collector treats every principal as a user, causing incorrect MFA, stale-account, and break-glass findings.

5. Cosmos DB and cache collection failures return empty lists. The rules interpret those empty lists as compliant inventories, creating silent false negatives.

6. AZ-STOR-009 reads period_since_creation_in_days, but the Azure SDK property is immutability_period_since_creation_in_days.

7. Several new rules compare Azure SDK enum objects using str(value) rather than normalizing .value. This affects TLS, encryption-source, audit-policy, and immutability-state checks.

8. AZ-IDN-021 and AZ-IDN-022 do not validate included users, exclusions, report-only state, or application scope. A policy covering only a subset of users can incorrectly suppress a tenant-wide finding.

Please correct these issues and add regression tests using representative Microsoft Graph payloads and actual Azure SDK model objects before merging.

[TFT444]

@parthrohit22 all 8 blockers from your review have been addressed in the latest commit. Quick summary of what changed: PIM collector now queries both roleAssignmentSchedules and roleEligibilitySchedules; IDN-023 uses CA-policy inspection instead of the unsupported endpoints; IDN-024 uses includeServicePrincipals with proper exclude logic; all principals now carry principalType; Cosmos/cache failures return None with a warning instead of an empty list; STOR-009 uses immutability_period_since_creation_in_days; enum comparisons use enum_str(); and IDN-021/022 validate user scope. Tests updated to match. Would appreciate a re-review when you get a chance.

[m-khan-97]

@TFT444, I have noted the commit addressing the eight SDK/API blockers. Since this branch is now significantly behind dev, please rebase it first and rerun the complete suite. I will verify the collector contracts and rule behavior against that fresh head rather than reviewing code that will change during conflict resolution.

[TFT444]

@m-khan-97 @parthrohit22 the branch has been rebased onto current dev and all 870 tracked tests pass with 0 failures. The 8 SDK/API blockers from Parth's review were addressed in a prior commit (PIM collector queries both roleAssignmentSchedules and roleEligibilitySchedules, IDN-023 uses CA policy inspection, IDN-024 uses includeServicePrincipals, all principals carry principalType, Cosmos/cache failures return None, enum comparisons use .value, IDN-021/022 validate scope). Also fixed the BM25 skip guard in test_ai_hallucination_guard.py which was raising instead of skipping when the index hasn't been built. Ready for re-review.