| name | cis-azure-foundations-2.1.6 |
| description | Ensure usage is restricted and expiry is enforced for Databricks personal access tokens |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","databricks","analytics"] |
| cis_id | 2.1.6 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | ["cis-azure-foundations-2.1.4"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure usage is restricted and expiry is enforced for Databricks personal access tokens
Description
Databricks personal access tokens (PATs) provide API-based authentication for users and applications. By default, users can generate API tokens without expiration, leading to potential security risks if tokens are leaked, improperly stored, or not rotated regularly.
To mitigate these risks, administrators should:
- Restrict token creation to approved users and service principals.
- Enforce expiration policies to prevent long-lived tokens.
- Monitor token usage and revoke unused or compromised tokens.
Rationale
Restricting usage and enforcing expiry for personal access tokens reduces exposure to long-lived tokens, minimizes the risk of API abuse if compromised, and aligns with security best practices through controlled issuance and enforced expiry.
Impact
If revoked improperly, applications relying on these tokens may fail, requiring a remediation plan for token rotation. Increased administrative effort is required to track and manage API tokens effectively.
Audit Procedure
Azure Databricks administrators can monitor and revoke personal access tokens within their workspace. Detailed instructions are available in the "Monitor and Revoke Personal Access Tokens" section of the Microsoft documentation: https://learn.microsoft.com/en-us/azure/databricks/admin/access-control/tokens.
To evaluate the usage of personal access tokens in your Azure Databricks account, you can utilize the provided notebook that lists all PATs not rotated or updated in the last 90 days, allowing you to identify tokens that may require revocation. This process is detailed here: https://learn.microsoft.com/en-us/azure/databricks/admin/access-control/tokens.
Implementing diagnostic logging provides a comprehensive reference of audit log services and events, enabling you to track activities related to personal access tokens. More information can be found in the diagnostic log reference section: https://learn.microsoft.com/en-us/azure/databricks/admin/account-settings/audit-logs.
Expected Result
Personal access tokens should either be disabled or have maximum lifetime policies enforced. Token creation should be restricted to approved users and service principals only. No tokens older than 90 days without rotation should exist.
Remediation
Remediate from Azure Portal
Disable personal access tokens:
If your workspace does not require PATs, you can disable them entirely to prevent their use.
