-
Notifications
You must be signed in to change notification settings - Fork 117
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #31 from maester365/fb_AdditionalChecks
Add new cmdlets and tests for Conditional Access policies
- Loading branch information
Showing
20 changed files
with
766 additions
and
141 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| <# | ||
| .Synopsis | ||
| Checks if the tenant has at least one conditional access policy is configured to enable application enforced restrictions | ||
| .Description | ||
| Application enforced restrictions conditional access policy can be helpful to minimize the risk of data leakage from a shared device. | ||
| Learn more: | ||
| https://aka.ms/CATemplatesAppRestrictions | ||
| .Example | ||
| Test-MtCaApplicationEnforcedRestrictions | ||
| #> | ||
|
|
||
| Function Test-MtCaApplicationEnforcedRestrictions { | ||
| [CmdletBinding()] | ||
| [OutputType([bool])] | ||
| param () | ||
|
|
||
| Set-StrictMode -Off | ||
| $policies = Get-MtConditionalAccessPolicies | Where-Object { $_.state -eq "enabled" } | ||
|
|
||
| $result = $false | ||
| foreach ($policy in $policies) { | ||
| if ( $policy.conditions.users.includeUsers -eq "All" ` | ||
| -and $policy.conditions.clientAppTypes -eq "All" ` | ||
| -and $policy.sessionControls.applicationEnforcedRestrictions.isEnabled -eq $true ` | ||
| -and "Office365" -in $policy.conditions.applications.includeApplications ` | ||
| ) { | ||
| $result = $true | ||
| $currentresult = $true | ||
| } else { | ||
| $currentresult = $false | ||
| } | ||
| Write-Verbose "$($policy.displayName) - $currentresult" | ||
| } | ||
| Set-StrictMode -Version Latest | ||
|
|
||
| return $result | ||
| } |
41 changes: 41 additions & 0 deletions
41
src/public/Test-MtCaBlockLegacyExchangeActiveSyncAuthentication.ps1
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| <# | ||
| .Synopsis | ||
| Checks if the tenant has at least one conditional access policy that blocks legacy authentication for Exchange Active Sync authentication. | ||
| .Description | ||
| Legacy authentication is an unsecure method to authenticate. This function checks if the tenant has at least one | ||
| conditional access policy that blocks legacy authentication. | ||
| Learn more: | ||
| https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-policy-block-legacy | ||
| .Example | ||
| Test-MtCaBlockLegacyExchangeActiveSyncAuthentication | ||
| #> | ||
|
|
||
| Function Test-MtCaBlockLegacyExchangeActiveSyncAuthentication { | ||
| [CmdletBinding()] | ||
| [OutputType([bool])] | ||
| param () | ||
|
|
||
| Set-StrictMode -Off | ||
| $policies = Get-MtConditionalAccessPolicies | Where-Object { $_.state -eq "enabled" } | ||
|
|
||
| $result = $false | ||
| foreach ($policy in $policies) { | ||
| if ( $policy.grantcontrols.builtincontrols -contains 'block' ` | ||
| -and "exchangeActiveSync" -in $policy.conditions.clientAppTypes ` | ||
| -and $policy.conditions.applications.includeApplications -eq "00000002-0000-0ff1-ce00-000000000000" ` | ||
| -and $policy.conditions.users.includeUsers -eq "All" ` | ||
| ) { | ||
| $result = $true | ||
| $currentresult = $true | ||
| } else { | ||
| $currentresult = $false | ||
| } | ||
| Write-Verbose "$($policy.displayName) - $currentresult" | ||
| } | ||
| Set-StrictMode -Version Latest | ||
|
|
||
| return $result | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| <# | ||
| .Synopsis | ||
| Checks if the tenant has at least one conditional access policy that blocks legacy authentication. | ||
| .Description | ||
| Legacy authentication is an unsecure method to authenticate. This function checks if the tenant has at least one | ||
| conditional access policy that blocks legacy authentication. | ||
| Learn more: | ||
| https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-policy-block-legacy | ||
| .Example | ||
| Test-MtCaBlockLegacyOtherAuthentication | ||
| #> | ||
|
|
||
| Function Test-MtCaBlockLegacyOtherAuthentication { | ||
| [CmdletBinding()] | ||
| [OutputType([bool])] | ||
| param () | ||
|
|
||
| Set-StrictMode -Off | ||
| $policies = Get-MtConditionalAccessPolicies | Where-Object { $_.state -eq "enabled" } | ||
| # Remove policies that require password change, as they are related to user risk and not MFA on signin | ||
| $policies = $policies | Where-Object { $_.grantcontrols.builtincontrols -notcontains 'passwordChange' } | ||
|
|
||
| $result = $false | ||
| foreach ($policy in $policies) { | ||
| if ( $policy.grantcontrols.builtincontrols -contains 'block' ` | ||
| -and "other" -in $policy.conditions.clientAppTypes ` | ||
| -and $policy.conditions.applications.includeApplications -eq "All" ` | ||
| -and $policy.conditions.users.includeUsers -eq "All" ` | ||
| ) { | ||
| $result = $true | ||
| $currentresult = $true | ||
| } else { | ||
| $currentresult = $false | ||
| } | ||
| Write-Verbose "$($policy.displayName) - $currentresult" | ||
| } | ||
| Set-StrictMode -Version Latest | ||
|
|
||
| return $result | ||
| } |
Oops, something went wrong.