Skip to content

Commit 6d69c85

Browse files
cblomartcblomart
authored
Merge pull request #52 from AzureAD/preview
Preview
2 parents e1fbadd + 47ed4c4 commit 6d69c85

9 files changed

+284
-96
lines changed

‎README.md‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,14 @@ Update-Module AzureADAssessment -Force -Scope CurrentUser
1919
Data collection from Azure AD can be run from any client with access to Azure AD. However, data collection from hybrid components such as AD FS, AAD Connect, etc. are best run locally on those servers. The AAD Connect data collection needs to be run on both Primary and Staging servers.
2020

2121
Verify that you have authorized credentials to access these workloads:
22-
* Azure Active Directory as Global Administrator or Global Reader (email OTP policy won't be reported by Global Reader)
22+
* Azure Active Directory as Global Administrator or Global Reader
2323
* Domain or local administrator access to ADFS Servers
2424
* Domain or local administrator access to Azure AD Proxy Connector Servers
2525
* Domain or local administrator access to Azure AD Connect Server (Primary)
2626
* Domain or local administrator access to Azure AD Connect Server (Staging Server)
2727

28+
> When Connecting for the first time you will be asked to consent to the permissions needed by the assessment. An admin will be needed to provide consent.
29+
2830
Run following commands to produce a package of all the Azure AD data necessary to complete the assessment.
2931
```PowerShell
3032
## Authenticate using a Global Admin or Global Reader account.
@@ -110,6 +112,17 @@ If you are using PowerShell Core (ie PowerShell 6 or 7) and your tenant has a co
110112

111113
To work around this issue use Windows PowerShell (instead of PowerShell 6 or 7). To launch Windows PowerShell go to **Start > Windows PowerShell**
112114

115+
### Unable to load data in PowerBI templates ###
116+
When you open the powerbi templates, you will be asked to reference the folder where the extracted data resides (csv and json). Once selected PowerBI will load the data.
117+
While doing so PowerBI might complain with errors crossreferncing data sources:
118+
```
119+
Query '*' (step '*') references other queries or steps, so it may not directly access a datasource. Please rebuild this data combination.
120+
```
121+
To workarround this, configure PowerBI file settings to ignore privacy settings:
122+
* **File > Options and settings > Options**
123+
* In **Options** under **CURRENT FILE** find the **Privacy**
124+
* In **Privacy Levels** select **Ignore the Privacy Levels and potentially improve performance**
125+
113126
## Contents
114127

115128
| File/folder | Description |

‎assets/AzureADAssessment-ConditionalAccess.pbit‎

-20.8 KB
Binary file not shown.

‎src/AADRecommendations.xml‎

Lines changed: 72 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -461,7 +461,7 @@
461461
<Sources>
462462
<File>conditionalAccessPolicies.json</File>
463463
<File>roleDefinitions.csv</File>
464-
<File>roleAssignments.csv</File>
464+
<File>RoleAssignmentReport.csv</File>
465465
<File>Users.csv</File>
466466
</Sources>
467467
<PowerShell>
@@ -472,7 +472,7 @@
472472
# get ga role id
473473
$gaRoleId = $Data["roleDefinitions.csv"] | Where-Object { $_.displayName -eq "Global Administrator"} | Select-Object -First 1 -ExpandProperty id
474474
# get permanently assigned GA users ids
475-
$GAids = $Data["roleAssignments.csv"] | Where-Object { $_.directoryScopeId -in ("/","unknown") -and $_.principalId -eq "user" -and $_.roleDefinitionId -eq $gaRoleId -and $_.assignmentType -eq "Active" } | Select-Object -ExpandProperty principalId
475+
$GAids = $Data["RoleAssignmentReport.csv"] | Where-Object { $_.directoryScopeId -in ("/","unknown") -and $_.principalType -eq "user" -and $_.roleDefinitionId -eq $gaRoleId -and $_.assignmentType -eq "Assigned" } | Select-Object -ExpandProperty principalId
476476
# filter cloud users - only keep cloud GAs
477477
$BGAids = $Data["users.csv"] | Where-Object { $_.id -in $GAids -and $_.onPremisesSyncEnabled -eq $false } | Select-Object -ExpandProperty id
478478

@@ -505,7 +505,7 @@
505505
<Sources>
506506
<File>conditionalAccessPolicies.json</File>
507507
<File>roleDefinitions.csv</File>
508-
<File>roleAssignments.csv</File>
508+
<File>RoleAssignmentReport.csv</File>
509509
<File>Users.csv</File>
510510
</Sources>
511511
<PowerShell>
@@ -516,7 +516,7 @@
516516
# get ga role id
517517
$gaRoleId = $Data["roleDefinitions.csv"] | Where-Object { $_.displayName -eq "Global Administrator"} | Select-Object -First 1 -ExpandProperty id
518518
# get permanently assigned GA users ids
519-
$GAids = $Data["roleAssignments.csv"] | Where-Object { $_.directoryScopeId -in ("/","unknown") -and $_.principalId -eq "user" -and $_.roleDefinitionId -eq $gaRoleId -and $_.assignmentType -eq "Active" } | Select-Object -ExpandProperty principalId
519+
$GAids = $Data["RoleAssignmentReport.csv"] | Where-Object { $_.directoryScopeId -in ("/","unknown") -and $_.principalType -eq "user" -and $_.roleDefinitionId -eq $gaRoleId -and $_.assignmentType -eq "Assigned" } | Select-Object -ExpandProperty principalId
520520
# filter cloud users - only keep cloud GAs
521521
$BGAids = $Data["users.csv"] | Where-Object { $_.id -in $GAids -and $_.onPremisesSyncEnabled -eq $false } | Select-Object -ExpandProperty id
522522

@@ -2186,7 +2186,7 @@
21862186
</Recommendation>
21872187
<Sources>
21882188
<File>roleDefinitions.csv</File>
2189-
<File>roleAssignments.csv</File>
2189+
<File>RoleAssignmentReport.csv</File>
21902190
<File>conditionalAccessPolicies.json</File>
21912191
</Sources>
21922192
<PowerShell>
@@ -2490,7 +2490,7 @@
24902490
<Name>Use PIM to grant just-in-time access</Name>
24912491
<Sources>
24922492
<File>roleDefinitions.csv</File>
2493-
<File>roleAssignments.csv</File>
2493+
<File>RoleAssignmentReport.csv</File>
24942494
</Sources>
24952495
<PowerShell>
24962496
param($Data)
@@ -2510,7 +2510,7 @@
25102510
$scopedRoleIds = $Data['roleDefinitions.csv'] | Where-Object { $_.DisplayName -in $securityDefaultRoles } | Select-Object -ExpandProperty id
25112511

25122512
# look for active permanent role assignements for those roles
2513-
$scopedActivePermanentAssignments = @($Data['roleAssignments.csv'] | Where-Object { $_.roleDefinitionId -in $scopedRoleIds -and $_.assignmentType -eq "Active" -and [string]::IsNullOrWhiteSpace($_.endDateTime) })
2513+
$scopedActivePermanentAssignments = @($Data['RoleAssignmentReport.csv'] | Where-Object { $_.roleDefinitionId -in $scopedRoleIds -and $_.assignmentType -eq "Assigned" -and [string]::IsNullOrWhiteSpace($_.endDateTime) })
25142514

25152515
$res.Priority = "Passed"
25162516
if ($scopedActivePermanentAssignments.Count -gt 0) {
@@ -2536,16 +2536,16 @@
25362536
<recommendation>
25372537
<Sources>
25382538
<File>roleDefinitions.csv</File>
2539-
<File>roleAssignments.csv</File>
2539+
<File>RoleAssignmentReport.csv</File>
25402540
<File>conditionalAccessPolicies.json</File>
25412541
</Sources>
25422542
<PowerShell>
25432543
param($Data)
25442544

25452545
$res = "" | select Priority,Data
25462546

2547-
# get role ids of each roles with an assignment
2548-
$scopedAssignments = @($Data['roleAssignments.csv'] | Select-Object -ExpandProperty roleDefinitionId)
2547+
# get role ids of each roles with an assignment (assigned or eligible)
2548+
$scopedAssignments = @($Data['RoleAssignmentReport.csv'] | Select-Object -ExpandProperty roleDefinitionId)
25492549

25502550
# get the role definitions of assigned roles
25512551
$roleDefintions = @($Data['roleDefinitions.csv'] | Where-Object { $_.id -in $scopedAssignments})
@@ -2859,7 +2859,7 @@
28592859
</Recommendation>
28602860
<Sources>
28612861
<File>roleDefinitions.csv</File>
2862-
<File>roleAssignments.csv</File>
2862+
<File>RoleAssignmentReport.csv</File>
28632863
<File>users.csv</File>
28642864
</Sources>
28652865
<PowerShell>
@@ -2870,7 +2870,7 @@
28702870
$GARoleId = $Data['roleDefinitions.csv'] | Where-Object { $_.DisplayName -eq "Global Administrator" } | Select-Object -ExpandProperty id
28712871

28722872
# look for users with assigned roles
2873-
$userIdsWithGA = @($Data['roleAssignments.csv'] | Where-Object { $_.roleDefinitionId -eq $GARoleId -and $_.principalType -eq "user"} | Select-Object -ExpandProperty principalId)
2873+
$userIdsWithGA = @($Data['RoleAssignmentReport.csv'] | Where-Object { $_.roleDefinitionId -eq $GARoleId -and $_.principalType -eq "user"} | Select-Object -ExpandProperty principalId)
28742874

28752875
# get GA users
28762876
$usersWithGA = @($Data['users.csv'] | Where-Object { $_.id -in $userIdsWithGA})
@@ -2900,7 +2900,7 @@
29002900
</Recommendation>
29012901
<Sources>
29022902
<File>roleDefinitions.csv</File>
2903-
<File>roleAssignments.csv</File>
2903+
<File>RoleAssignmentReport.csv</File>
29042904
<File>users.csv</File>
29052905
</Sources>
29062906
<PowerShell>
@@ -2921,7 +2921,7 @@
29212921
$scopedRoleIds = $Data['roleDefinitions.csv'] | Where-Object { $_.DisplayName -in $securityDefaultRoles } | Select-Object -ExpandProperty id
29222922

29232923
# look for users with assigned roles
2924-
$usersWithRole = @($Data['roleAssignments.csv'] | Where-Object { $_.roleDefinitionId -in $scopedRoleIds -and $_.principalType -eq "user"} | Select-Object -ExpandProperty principalId)
2924+
$usersWithRole = @($Data['RoleAssignmentReport.csv'] | Where-Object { $_.roleDefinitionId -in $scopedRoleIds -and $_.principalType -eq "user"} | Select-Object -ExpandProperty principalId)
29252925

29262926
# get the synced users
29272927
$syncedUsersWithRole = @($Data['users.csv'] | Where-Object { $_.id -in $usersWithRole -and ($_.onPremisesSyncEnabled -eq "True" -or $_.onPremisesImmutableId -eq "True")})
@@ -2989,7 +2989,7 @@
29892989

29902990
#### Learn More
29912991

2992-
- [Trusted Locations | Microsoft Docs](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition#trusted-locations)
2992+
- [Trusted Locations | Microsoft Docs](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition)
29932993
</Recommendation>
29942994
</recommendation>
29952995

@@ -3015,7 +3015,7 @@
30153015

30163016
#### Learn More
30173017

3018-
- [Trusted Locations | Microsoft Docs](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition#trusted-locations)
3018+
- [Trusted Locations | Microsoft Docs](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition)
30193019
</Recommendation>
30203020
</recommendation>
30213021

@@ -3042,7 +3042,7 @@
30423042

30433043
#### Learn More
30443044

3045-
- [Trusted Locations | Microsoft Docs](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition#trusted-locations)
3045+
- [Trusted Locations | Microsoft Docs](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition)
30463046
</Recommendation>
30473047
</recommendation>
30483048

@@ -3074,6 +3074,61 @@
30743074
</Recommendation>
30753075
</recommendation>
30763076

3077+
<recommendation>
3078+
<Category>Access Management</Category>
3079+
<Area>Access Policies</Area>
3080+
<ID>AR0095</ID>
3081+
<Type>QnA</Type>
3082+
<QnA>
3083+
<Name>AccMgmt_Did_you_find_customer_is_licensed_for_Intune_and_there_is_desire_to_allow_personal_devices_use_but_MAM_is_not_deployed</Name>
3084+
<Answers>
3085+
<Answer Value="Yes" Priority = "P1"/>
3086+
<Answer Value="No" Priority = "Passed"/>
3087+
</Answers>
3088+
</QnA>
3089+
<Name>MAM Client App Access Policy for Personal Devices</Name>
3090+
<Summary>
3091+
Microsoft Intune Application Management (MAM) provides the ability to push data protection controls such as storage encryption, PIN, remote storage cleanup, etc. to compatible client mobile applications such as Outlook.
3092+
3093+
Then, Conditional Access can enforce policies that will restrict access to cloud services (such as Exchange Online) from approved/compatible apps.
3094+
</Summary>
3095+
<Recommendation>
3096+
- Deploy application MAM policies to manage the application configuration in personal owned devices without MDM enrollment.
3097+
- Update Conditional Access policies to only allow access from MAM capable clients.
3098+
3099+
#### Learn More
3100+
3101+
- [Conditional Access: Require approved client apps or app protection policy | Microsoft Docs](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection)
3102+
</Recommendation>
3103+
</recommendation>
3104+
3105+
<recommendation>
3106+
<Category>Access Management</Category>
3107+
<Area>Access Policies</Area>
3108+
<ID>AR0096</ID>
3109+
<Type>QnA</Type>
3110+
<QnA>
3111+
<Name>AccMgmt_Did_you_find_customer_is_licensed_for_Intune_and_there_is_desire_to_allow_corporate_devices_use_but_MAM_is_not_deployed</Name>
3112+
<Answers>
3113+
<Answer Value="Yes" Priority = "P3"/>
3114+
<Answer Value="No" Priority = "Passed"/>
3115+
</Answers>
3116+
</QnA>
3117+
<Name>MAM Client App Access Policy for Corporate Devices</Name>
3118+
<Summary>
3119+
Microsoft Intune Application Management (MAM) provides the ability to push data protection controls such as storage encryption, PIN, remote storage cleanup, etc. to compatible client mobile applications such as Outlook.
3120+
3121+
Then, Conditional Access can enforce policies that will restrict access to cloud services (such as Exchange Online) from approved/compatible apps.
3122+
</Summary>
3123+
<Recommendation>
3124+
- Deploy application MAM policies to manage the application configuration and be future proof for personal devices.
3125+
- Update Conditional Access policies to only allow access from MAM capable clients.
3126+
3127+
#### Learn More
3128+
3129+
- [Conditional Access: Require approved client apps or app protection policy | Microsoft Docs](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection)
3130+
</Recommendation>
3131+
</recommendation>
30773132

30783133
<!--
30793134
<recommendation>

0 commit comments

Comments
 (0)