Skip to content

Commit 1ef2c30

Browse files
KelvinTegelaarKelvinTegelaar
committed
NEw tests, not tested
1 parent 90a084f commit 1ef2c30

9 files changed

+295
-2
lines changed

‎Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -198,6 +198,10 @@ function Push-CIPPDBCacheData {
198198
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoAcceptedDomains collection failed: $($_.Exception.Message)" -sev Error
199199
}
200200

201+
try { Set-CIPPDBCacheIntuneAppProtectionPolicies -TenantFilter $TenantFilter } catch {
202+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "IntuneAppProtectionPolicies collection failed: $($_.Exception.Message)" -sev Error
203+
}
204+
201205
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Completed database cache collection for tenant' -sev Info
202206

203207
} catch {

‎Modules/CIPPCore/Public/Set-CIPPDBCacheIntuneAppProtectionPolicies.ps1‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
function Set-CIPPDBCacheIntuneAppProtectionPolicies {
2+
<#
3+
.SYNOPSIS
4+
Caches Intune App Protection Policies
5+
6+
.PARAMETER TenantFilter
7+
The tenant to cache app protection policies for
8+
#>
9+
[CmdletBinding()]
10+
param(
11+
[Parameter(Mandatory = $true)]
12+
[string]$TenantFilter
13+
)
14+
15+
try {
16+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Intune App Protection Policies' -sev Info
17+
18+
# iOS Managed App Protection Policies
19+
$IosPolicies = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/deviceAppManagement/iosManagedAppProtections?$expand=assignments' -tenantid $TenantFilter
20+
if ($IosPolicies) {
21+
Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'IntuneIosAppProtectionPolicies' -Data $IosPolicies
22+
Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'IntuneIosAppProtectionPolicies' -Data $IosPolicies -Count
23+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($IosPolicies.Count) iOS app protection policies" -sev Info
24+
}
25+
$IosPolicies = $null
26+
27+
# Android Managed App Protection Policies
28+
$AndroidPolicies = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/deviceAppManagement/androidManagedAppProtections?$expand=assignments' -tenantid $TenantFilter
29+
if ($AndroidPolicies) {
30+
Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'IntuneAndroidAppProtectionPolicies' -Data $AndroidPolicies
31+
Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'IntuneAndroidAppProtectionPolicies' -Data $AndroidPolicies -Count
32+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($AndroidPolicies.Count) Android app protection policies" -sev Info
33+
}
34+
$AndroidPolicies = $null
35+
36+
} catch {
37+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache App Protection Policies: $($_.Exception.Message)" -sev Error
38+
}
39+
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA21865.ps1‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,8 @@ function Invoke-CippTestZTNA21865 {
3030
foreach ($Location in $NamedLocations) {
3131
$Name = $Location.displayName
3232
$Type = if ($Location.'@odata.type' -eq '#microsoft.graph.ipNamedLocation') { 'IP-based' }
33-
elseif ($Location.'@odata.type' -eq '#microsoft.graph.countryNamedLocation') { 'Country-based' }
34-
else { 'Unknown' }
33+
elseif ($Location.'@odata.type' -eq '#microsoft.graph.countryNamedLocation') { 'Country-based' }
34+
else { 'Unknown' }
3535
$Trusted = if ($Location.isTrusted) { 'Yes' } else { 'No' }
3636
$ResultMarkdown += "| $Name | $Type | $Trusted |`n"
3737
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA21964.ps1‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
function Invoke-CippTestZTNA21964 {
2+
param($Tenant)
3+
4+
$TestId = 'ZTNA21964'
5+
6+
try {
7+
$AuthStrengths = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationStrengths'
8+
9+
if (-not $AuthStrengths) {
10+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Investigate' -ResultMarkdown 'Authentication strength policies not found in database' -Risk 'High' -Name 'Enable protected actions to secure Conditional Access policy creation and changes' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Access control'
11+
return
12+
}
13+
14+
$BuiltInStrengths = @($AuthStrengths | Where-Object { $_.policyType -eq 'builtIn' })
15+
$CustomStrengths = @($AuthStrengths | Where-Object { $_.policyType -eq 'custom' })
16+
17+
$ResultMarkdown = "## Authentication Strength Policies`n`n"
18+
$ResultMarkdown += "Found $($AuthStrengths.Count) authentication strength policies ($($BuiltInStrengths.Count) built-in, $($CustomStrengths.Count) custom).`n`n"
19+
20+
if ($CustomStrengths.Count -gt 0) {
21+
$ResultMarkdown += "### Custom Authentication Strengths`n`n"
22+
$ResultMarkdown += "| Name | Combinations |`n"
23+
$ResultMarkdown += "| :--- | :---------- |`n"
24+
foreach ($strength in $CustomStrengths) {
25+
$combinations = if ($strength.allowedCombinations) { $strength.allowedCombinations.Count } else { 0 }
26+
$ResultMarkdown += "| $($strength.displayName) | $combinations methods |`n"
27+
}
28+
}
29+
30+
$Status = 'Passed'
31+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Enable protected actions to secure Conditional Access policy creation and changes' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Access control'
32+
33+
} catch {
34+
$ErrorMessage = Get-CippException -Exception $_
35+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
36+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Enable protected actions to secure Conditional Access policy creation and changes' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Access control'
37+
}
38+
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA24545.ps1‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
function Invoke-CippTestZTNA24545 {
2+
param($Tenant)
3+
4+
$TestId = 'ZTNA24545'
5+
6+
try {
7+
$IntunePolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntunePolicies'
8+
9+
if (-not $IntunePolicies) {
10+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Investigate' -ResultMarkdown 'Intune policies not found in database' -Risk 'High' -Name 'Compliance policies protect fully managed and corporate-owned Android devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
11+
return
12+
}
13+
14+
$AndroidPolicies = @($IntunePolicies | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.androidDeviceOwnerCompliancePolicy' })
15+
$AssignedPolicies = @($AndroidPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
16+
17+
$Passed = $AssignedPolicies.Count -gt 0
18+
19+
if ($Passed) {
20+
$ResultMarkdown = "✅ At least one compliance policy for Android Enterprise Fully managed devices exists and is assigned.`n`n"
21+
} else {
22+
$ResultMarkdown = "❌ No compliance policy for Android Enterprise exists or none are assigned.`n`n"
23+
}
24+
25+
$ResultMarkdown += "## Android Device Owner Compliance Policies`n`n"
26+
$ResultMarkdown += "| Policy Name | Assigned |`n"
27+
$ResultMarkdown += "| :---------- | :------- |`n"
28+
29+
foreach ($policy in $AndroidPolicies) {
30+
$assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
31+
$ResultMarkdown += "| $($policy.displayName) | $assigned |`n"
32+
}
33+
34+
$Status = if ($Passed) { 'Passed' } else { 'Failed' }
35+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Compliance policies protect fully managed and corporate-owned Android devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
36+
37+
} catch {
38+
$ErrorMessage = Get-CippException -Exception $_
39+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
40+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Compliance policies protect fully managed and corporate-owned Android devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
41+
}
42+
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA24547.ps1‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
function Invoke-CippTestZTNA24547 {
2+
param($Tenant)
3+
4+
$TestId = 'ZTNA24547'
5+
6+
try {
7+
$IntunePolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntunePolicies'
8+
9+
if (-not $IntunePolicies) {
10+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Investigate' -ResultMarkdown 'Intune policies not found in database' -Risk 'High' -Name 'Compliance policies protect personally owned Android devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
11+
return
12+
}
13+
14+
$AndroidPolicies = @($IntunePolicies | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.androidWorkProfileCompliancePolicy' })
15+
$AssignedPolicies = @($AndroidPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
16+
17+
$Passed = $AssignedPolicies.Count -gt 0
18+
19+
if ($Passed) {
20+
$ResultMarkdown = "✅ At least one compliance policy for Android Work Profile devices exists and is assigned.`n`n"
21+
} else {
22+
$ResultMarkdown = "❌ No compliance policy for Android Work Profile exists or none are assigned.`n`n"
23+
}
24+
25+
$ResultMarkdown += "## Android Work Profile Compliance Policies`n`n"
26+
$ResultMarkdown += "| Policy Name | Assigned |`n"
27+
$ResultMarkdown += "| :---------- | :------- |`n"
28+
29+
foreach ($policy in $AndroidPolicies) {
30+
$assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
31+
$ResultMarkdown += "| $($policy.displayName) | $assigned |`n"
32+
}
33+
34+
$Status = if ($Passed) { 'Passed' } else { 'Failed' }
35+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Compliance policies protect personally owned Android devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
36+
37+
} catch {
38+
$ErrorMessage = Get-CippException -Exception $_
39+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
40+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Compliance policies protect personally owned Android devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
41+
}
42+
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA24548.ps1‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
function Invoke-CippTestZTNA24548 {
2+
param($Tenant)
3+
4+
$TestId = 'ZTNA24548'
5+
6+
try {
7+
$IosPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneIosAppProtectionPolicies'
8+
9+
if (-not $IosPolicies) {
10+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Investigate' -ResultMarkdown 'iOS app protection policies not found in database' -Risk 'High' -Name 'Data on iOS/iPadOS is protected by app protection policies' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
11+
return
12+
}
13+
14+
$AssignedPolicies = @($IosPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
15+
$Passed = $AssignedPolicies.Count -gt 0
16+
17+
if ($Passed) {
18+
$ResultMarkdown = "✅ At least one iOS app protection policy exists and is assigned.`n`n"
19+
} else {
20+
$ResultMarkdown = "❌ No iOS app protection policy exists or none are assigned.`n`n"
21+
}
22+
23+
$ResultMarkdown += "## iOS App Protection Policies`n`n"
24+
$ResultMarkdown += "| Policy Name | Assigned |`n"
25+
$ResultMarkdown += "| :---------- | :------- |`n"
26+
27+
foreach ($policy in $IosPolicies) {
28+
$assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
29+
$ResultMarkdown += "| $($policy.displayName) | $assigned |`n"
30+
}
31+
32+
$Status = if ($Passed) { 'Passed' } else { 'Failed' }
33+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Data on iOS/iPadOS is protected by app protection policies' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
34+
35+
} catch {
36+
$ErrorMessage = Get-CippException -Exception $_
37+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
38+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Data on iOS/iPadOS is protected by app protection policies' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
39+
}
40+
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA24549.ps1‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
function Invoke-CippTestZTNA24549 {
2+
param($Tenant)
3+
4+
$TestId = 'ZTNA24549'
5+
6+
try {
7+
$AndroidPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneAndroidAppProtectionPolicies'
8+
9+
if (-not $AndroidPolicies) {
10+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Investigate' -ResultMarkdown 'Android app protection policies not found in database' -Risk 'High' -Name 'Data on Android is protected by app protection policies' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
11+
return
12+
}
13+
14+
$AssignedPolicies = @($AndroidPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
15+
$Passed = $AssignedPolicies.Count -gt 0
16+
17+
if ($Passed) {
18+
$ResultMarkdown = "✅ At least one Android app protection policy exists and is assigned.`n`n"
19+
} else {
20+
$ResultMarkdown = "❌ No Android app protection policy exists or none are assigned.`n`n"
21+
}
22+
23+
$ResultMarkdown += "## Android App Protection Policies`n`n"
24+
$ResultMarkdown += "| Policy Name | Assigned |`n"
25+
$ResultMarkdown += "| :---------- | :------- |`n"
26+
27+
foreach ($policy in $AndroidPolicies) {
28+
$assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
29+
$ResultMarkdown += "| $($policy.displayName) | $assigned |`n"
30+
}
31+
32+
$Status = if ($Passed) { 'Passed' } else { 'Failed' }
33+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Data on Android is protected by app protection policies' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
34+
35+
} catch {
36+
$ErrorMessage = Get-CippException -Exception $_
37+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
38+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Data on Android is protected by app protection policies' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
39+
}
40+
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA24553.ps1‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
function Invoke-CippTestZTNA24553 {
2+
param($Tenant)
3+
4+
$TestId = 'ZTNA24553'
5+
6+
try {
7+
$IntunePolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntunePolicies'
8+
9+
if (-not $IntunePolicies) {
10+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Investigate' -ResultMarkdown 'Intune policies not found in database' -Risk 'High' -Name 'Windows Update policies are enforced to reduce risk from unpatched vulnerabilities' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
11+
return
12+
}
13+
14+
$UpdatePolicies = @($IntunePolicies | Where-Object {
15+
$_.'@odata.type' -in @(
16+
'#microsoft.graph.windowsUpdateForBusinessConfiguration',
17+
'#microsoft.graph.windows10CompliancePolicy'
18+
)
19+
})
20+
21+
$AssignedPolicies = @($UpdatePolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
22+
$Passed = $AssignedPolicies.Count -gt 0
23+
24+
if ($Passed) {
25+
$ResultMarkdown = "✅ Windows Update policies are configured and assigned.`n`n"
26+
} else {
27+
$ResultMarkdown = "❌ No Windows Update policies are configured or assigned.`n`n"
28+
}
29+
30+
$ResultMarkdown += "## Windows Update Policies`n`n"
31+
$ResultMarkdown += "| Policy Name | Type | Assigned |`n"
32+
$ResultMarkdown += "| :---------- | :--- | :------- |`n"
33+
34+
foreach ($policy in $UpdatePolicies) {
35+
$type = if ($policy.'@odata.type' -eq '#microsoft.graph.windowsUpdateForBusinessConfiguration') { 'Update' } else { 'Compliance' }
36+
$assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
37+
$ResultMarkdown += "| $($policy.displayName) | $type | $assigned |`n"
38+
}
39+
40+
$Status = if ($Passed) { 'Passed' } else { 'Failed' }
41+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Windows Update policies are enforced to reduce risk from unpatched vulnerabilities' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
42+
43+
} catch {
44+
$ErrorMessage = Get-CippException -Exception $_
45+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
46+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Windows Update policies are enforced to reduce risk from unpatched vulnerabilities' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
47+
}
48+
}

0 commit comments

Comments
 (0)