implementing-zero-trust-for-saas-applications

为 SaaS 应用实施零信任

何时使用

• 在保护对 SaaS 应用（Microsoft 365、Google Workspace、Salesforce、Slack）的访问时
• 在实施要求 SaaS 使用 MFA 和设备合规的条件访问策略时
• 在部署 CASB 以发现影子 IT 和阻止未经批准的应用程序时
• 在针对敏感 SaaS 数据强制执行会话级控制（DLP、下载限制）时
• 在治理 OAuth 应用权限并检测过度授权同意时

请勿使用 作为 SaaS 原生安全控制的替代品（请先配置这些控制），也不适用于不支持 SAML/OIDC 的应用程序，或 SaaS 供应商不支持 CASB/SSPM 的 API 集成时。

先决条件

• 具备条件访问的身份提供程序：Microsoft Entra ID P1/P2、Okta
• CASB 解决方案：Microsoft Defender for Cloud Apps、Netskope 或 Zscaler CASB
• 已通过 SAML 2.0 或 OIDC 配置 SSO 的 SaaS 应用程序
• 用于设备合规信号的 MDM 注册（Intune、Jamf）
• 为敏感数据类别定义的 DLP 策略

工作流

步骤 1：通过身份提供程序联合 SaaS 身份验证

通过单一 IdP 集中所有 SaaS 应用程序的身份验证。

# Configure SAML SSO for Salesforce via Entra ID
Connect-MgGraph -Scopes "Application.ReadWrite.All"

# Create enterprise application for Salesforce
$app = New-MgServicePrincipal -AppId "SALESFORCE_APP_ID" -DisplayName "Salesforce"

# Configure SAML SSO settings
$samlSettings = @{
    preferredSingleSignOnMode = "saml"
    samlSingleSignOnSettings = @{
        relayState = ""
    }
}
Update-MgServicePrincipal -ServicePrincipalId $app.Id -BodyParameter $samlSettings

# Assign user groups to the application
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $app.Id -BodyParameter @{
    principalId = "SALES_GROUP_ID"
    resourceId = $app.Id
    appRoleId = "DEFAULT_ROLE_ID"
}

步骤 2：为 SaaS 应用程序创建条件访问策略

在授予 SaaS 访问权限之前强制执行身份和设备要求。

# Block access from non-compliant devices to sensitive SaaS apps
$policy = @{
    displayName = "ZT - Require Compliant Device for SaaS"
    state = "enabled"
    conditions = @{
        applications = @{
            includeApplications = @("SALESFORCE_APP_ID", "M365_APP_ID", "SLACK_APP_ID")
        }
        users = @{
            includeUsers = @("All")
            excludeGroups = @("BREAK_GLASS_GROUP")
        }
        clientAppTypes = @("browser", "mobileAppsAndDesktopClients")
    }
    grantControls = @{
        operator = "AND"
        builtInControls = @("mfa", "compliantDevice")
    }
    sessionControls = @{
        cloudAppSecurity = @{
            isEnabled = $true
            cloudAppSecurityType = "mcasConfigured"
        }
        signInFrequency = @{
            value = 8
            type = "hours"
            isEnabled = $true
        }
    }
}
New-MgIdentityConditionalAccessPolicy -BodyParameter $policy

# Block downloads on unmanaged devices
$downloadPolicy = @{
    displayName = "ZT - Block Downloads on Unmanaged Devices"
    state = "enabled"
    conditions = @{
        applications = @{ includeApplications = @("SHAREPOINT_APP_ID") }
        users = @{ includeUsers = @("All") }
        devices = @{
            deviceFilter = @{
                mode = "include"
                rule = "device.isCompliant -ne True -or device.trustType -ne 'ServerAD'"
            }
        }
    }
    sessionControls = @{
        cloudAppSecurity = @{
            isEnabled = $true
            cloudAppSecurityType = "mcasConfigured"
        }
    }
}
New-MgIdentityConditionalAccessPolicy -BodyParameter $downloadPolicy

步骤 3：部署 CASB 以发现影子 IT 和应用治理

配置 Microsoft Defender for Cloud Apps 以发现和控制 SaaS 使用。

# Query discovered cloud apps via Defender for Cloud Apps API
curl -X GET "https://api.cloudappsecurity.com/api/v1/discovery/" \
  -H "Authorization: Token ${MDCA_API_TOKEN}" \
  -H "Content-Type: application/json"

# Get list of unsanctioned apps
curl -X GET "https://api.cloudappsecurity.com/api/v1/discovery/discovered_apps/" \
  -H "Authorization: Token ${MDCA_API_TOKEN}" \
  -d '{
    "filters": {
      "appTag": {"eq": "unsanctioned"},
      "traffic": {"gte": 1000}
    },
    "sortField": "traffic",
    "sortDirection": "desc"
  }'

# Create session policy for DLP enforcement
curl -X POST "https://api.cloudappsecurity.com/api/v1/policies/" \
  -H "Authorization: Token ${MDCA_API_TOKEN}" \
  -d '{
    "name": "Block PII Upload to SaaS",
    "policyType": "SESSION",
    "severity": "HIGH",
    "enabled": true,
    "sessionPolicyType": "CONTROL_UPLOAD",
    "filters": {
      "fileType": {"eq": ["DOCUMENT", "SPREADSHEET"]},
      "contentInspection": {
        "dataType": ["CREDIT_CARD", "SSN", "PASSPORT"]
      }
    },
    "actions": {
      "block": true,
      "notify": {
        "emailRecipients": ["[email protected]"]
      }
    }
  }'

步骤 4：配置 OAuth 应用治理

审查并限制 OAuth 应用权限以防止过度授权同意。

# Query OAuth apps with high-privilege permissions
$oauthApps = Invoke-MgGraphRequest -Method GET `
  "https://graph.microsoft.com/v1.0/servicePrincipals?\$filter=tags/any(t:t eq 'WindowsAzureActiveDirectoryIntegratedApp')&\$select=displayName,appId,oauth2PermissionScopes"

# Review consent grants
$grants = Get-MgOauth2PermissionGrant -All
$highRisk = $grants | Where-Object {
    $_.Scope -match "Mail.ReadWrite|Files.ReadWrite.All|Directory.ReadWrite.All"
}

Write-Host "High-risk OAuth grants: $($highRisk.Count)"
$highRisk | ForEach-Object {
    $sp = Get-MgServicePrincipal -ServicePrincipalId $_.ClientId
    Write-Host "  App: $($sp.DisplayName) | Scope: $($_.Scope) | Type: $($_.ConsentType)"
}

# Configure app consent policy to require admin approval
$consentPolicy = @{
    displayName = "Require Admin Approval for High-Risk Permissions"
    conditions = @{
        clientApplications = @{ includeAllClientApplications = $true }
        permissions = @{
            permissionClassification = "high"
            permissions = @(
                @{ permissionValue = "Mail.ReadWrite"; permissionType = "delegated" }
                @{ permissionValue = "Files.ReadWrite.All"; permissionType = "delegated" }
            )
        }
    }
}

步骤 5：实施 SaaS 安全态势管理（SSPM）

审计并修复 SaaS 安全配置漂移。

# Query SaaS security posture via CASB API
curl -X GET "https://api.cloudappsecurity.com/api/v1/security_config/" \
  -H "Authorization: Token ${MDCA_API_TOKEN}" \
  -d '{"app": "Microsoft 365"}'

# Common SSPM checks:
# - MFA enforcement for all admin accounts
# - External sharing restrictions in SharePoint/OneDrive
# - Email forwarding rules to external domains blocked
# - Idle session timeout configured (< 8 hours)
# - Legacy authentication protocols disabled
# - Admin consent workflow enabled
# - Conditional access policies active
# - Audit logging enabled for all services

关键概念

术语	定义
CASB	云访问安全代理 - 在用户和 SaaS 应用程序之间强制执行安全策略的中间层
SSPM	SaaS 安全态势管理 - 持续监控 SaaS 应用程序安全配置
OAuth 治理	审查和控制通过 OAuth 同意流程授予的第三方应用权限
会话控制	在活动 SaaS 会话期间应用的实时访问限制（阻止下载、DLP 检查、水印）
影子 IT	员工未经 IT 批准或安全审查而使用的未经授权的 SaaS 应用程序
条件访问	在授予 SaaS 访问权限之前评估身份、设备、位置和风险信号的政策引擎

工具与系统

• Microsoft Defender for Cloud Apps：提供影子 IT 发现、会话控制、DLP 和 SSPM 的 CASB
• Microsoft Entra ID Conditional Access：用于对 SaaS 应用程序进行基于身份访问控制的策略引擎
• Netskope CASB：具有内联和基于 API 的 SaaS 安全控制的云原生 CASB
• Okta Identity Governance：SaaS 应用程序的 OAuth 应用治理和访问认证
• SSPM 工具：AppOmni、Adaptive Shield、Valence Security，用于 SaaS 配置监控

常见场景

场景：为 1,000 用户组织保护 Microsoft 365 和 Salesforce

背景：一家拥有 1,000 名用户的专业服务公司使用 Microsoft 365、Salesforce、Slack 以及 20+ 个其他 SaaS 应用。行业内发生的多起数据泄露事件推动了针对所有 SaaS 访问的零信任计划。

方法：

1. 通过 Entra ID 使用 SAML SSO 联合所有 SaaS 身份验证
2. 创建条件访问策略，要求所有 SaaS 应用使用 MFA + 合规设备
3. 部署 Defender for Cloud Apps 进行影子 IT 发现（识别 150+ 个未授权应用）
4. 将未授权应用标记为未批准，并通过 SWG/代理进行阻止
5. 配置会话控制：在非托管设备上阻止下载，对文件上传启用 DLP
6. 审查 OAuth 应用权限：撤销 45 个高风险同意授权，启用管理员审批工作流
7. 为 Microsoft 365 和 Salesforce 配置启用 SSPM 监控
8. 为安全领导层设置每周自动化态势报告

陷阱：条件访问策略需要紧急访问排除项。一些旧版 SaaS 应用可能不支持现代身份验证。会话控制需要基于代理的 CASB，这可能影响性能。撤销 OAuth 应用可能会破坏集成；请先与应用所有者协调。

输出格式

Zero Trust SaaS Security Report
==================================================
Organization: ProServices Corp
Report Date: 2026-02-23

SAAS INVENTORY:
  Sanctioned Apps: 25
  Unsanctioned (blocked): 127
  Shadow IT Users: 342 (discovered in last 30 days)

CONDITIONAL ACCESS:
  Policies active: 8
  Sign-ins evaluated: 456,789
  Blocked by policy: 2,345 (0.5%)
  MFA enforced: 100% of sign-ins

DEVICE COMPLIANCE:
  Compliant device required: All 25 sanctioned apps
  Sign-ins from compliant: 448,123 (98.1%)
  Sign-ins blocked (non-compliant): 8,666

CASB / DLP:
  DLP violations detected: 89
  Files blocked from upload: 34
  Downloads blocked (unmanaged): 1,234

OAUTH GOVERNANCE:
  Total OAuth apps: 312
  High-risk permissions: 12 (reviewed)
  Revoked consents: 45
  Pending admin approval: 8

SSPM FINDINGS:
  Critical misconfigurations: 3
  High: 7
  Medium: 15
  Remediated this month: 18