MDM Audit

Purpose

Audit cloud MDM Device Assignments and Agent Status

Answers it will provide

Do all active users have an active device?
Are all active devices assigned to a user?
Are any deprovisioned users assigned an active device?
Are there potential MDM agent issues? (e.g. agent has stopped checking in)
Are any devices active in Azure AD but not in MDM?

SaaS Option

If you would like to have this as a SaaS product vs a set of scripts, create an issue so the need can be scoped.

Current Integrations (create issue to request new integrations)

IDP

Okta

MDM

Jamf
Azure (Intune)

Requirements

Python3
Python3 pip

Execution

Install requirements

pip3 install -r requirements.txt

The below can all be used at the same time, if desired.

Caching IDP data

python3 main.py --idp=okta

Caching MDM data example

All MDMs must be cached at the same time

```
python3 main.py --mdm=jamf,azure
```

Running checks

python3 main.py --run_checks

Example Output

[*] No Device Assigned to {EMAIL}
[*] Jamf device with no email set: {DEVICE_NAME}
[*] Jamf agent may be broken: {DEVICE_NAME}
[*] Azure device is registered but not in MDM {DEVICE_NAME} - {MANUFACTURER} - {MODEL} - {OPERATING_SYSTEM}
[*] Deprovisioned user with active device {DEVICE_NAME} - User deprovisioned: {USER_STATUS_CHANGE_DATE} - Device last Active: {LAST_CONTACT_TIME}

Customization

The lib/constants.py file has a couple of things that you can customize. The current settings are a resonable balance.

USER_TYPES_TO_ANALYZE: IDP user types to analyze, e.g. "Full Time"
SECONDS_SINCE_CHECKIN_TO_BE_ACTIVE: How recently a device has to have checked in to be seen as "active"
SECONDS_BETWEEN_DEPROVISION_AND_ACTIVE_DEVICE: How long between a user being deprovisioned and their device still being active to be suspicious. e.g. The employee has been gone for over 2 weeks but their device has been active within the last 2 weeks.

mdm-audit commandments for new integrations

Thou shalt only have 1 IDP as your user source of truth.

Thou shalt use the below IDP normalization format.

{
    "email": {STRING},
    "status": {STRING},
    "created": {STRING},
    "status_changed": {STRING},
    "user_type": {STRING}
}

Thou shalt use the below MDM normalization format

{
    "source": {STRING},
    "mdm": {STRING},
    "manufacturer": {STRING},
    "model": {STRING},
    "operating_system": {STRING},
    "computer_name": {STRING},
    "last_contact_time": {STRING},
    "last_report_date": {STRING},
    "email": {STRING},
}

Thou shalt use the following time format:

2022-09-01T15:04:12Z

Ucnt/mdm-audit