Adding Entra ID or Azure Active Directory Username or Group Name Within Custom Rules

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

How to properly specify Azure AD or Entra ID Usernames and/or Group Names in Custom Rules.

Environment

• App Control Console: All Supported Versions
• App Control Agent: All Supported Versions
• Microsoft Entra ID (Azure AD)

Cause

• Azure AD (Entra ID) does not use Security Identifiers (SIDs) in the same way as on-premise Active Directory.
  • Instead, it uses a combination of unique identifiers and security tokens for authentication and authorization in the cloud.
  • This combination generates a Group ID or Object ID rather than a SID.
• App Control currently does not support these differences when attempting to retrieve the SID from a specified Azure AD or Entra ID Username and/or Group Name.

Resolution

A feature request was opened and tracked under EPCB-17112 for future consideration. In the meantime, specifying the SID directly in the Custom Rule will work. To do this, choose one of the following options:

• Use PowerShell with Get-AzAdUser or Get-AzureADDirectoryRole
• Use Microsoft Graph Explorer to convert Entra Roles to SIDs
• Open a ticket with Microsoft to request assistance in determining the relevant SID
• Use a third-party tool (such as Convert-AzureAdObjectIdToSid) to help convert Azure Object IDs to SIDs

Additional Information

• Integrate on-premises Active Directory domains with Microsoft Entra ID
• Manage device identities using the Microsoft Entra admin center
• Security Identifiers