Skip to content

Commit 568d1b8

Browse files
JohnDupreyJohnDuprey
committed
more standards
1 parent 5bfc23f commit 568d1b8

8 files changed

+104
-65
lines changed

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPWcompanionAppAllowedState.ps1‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,14 +29,11 @@ function Invoke-CIPPStandardPWcompanionAppAllowedState {
2929
#>
3030

3131
param($Tenant, $Settings)
32-
##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'PWcompanionAppAllowedState'
3332

3433
$authenticatorFeaturesState = (New-GraphGetRequest -tenantid $Tenant -Uri 'https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/microsoftAuthenticator' -Type GET)
3534
$authState = if ($authenticatorFeaturesState.featureSettings.companionAppAllowedState.state -eq 'enabled') { $true } else { $false }
3635

37-
if ($Settings.report -eq $true) {
38-
Add-CIPPBPAField -FieldName 'companionAppAllowedState' -FieldValue $authState -StoreAs bool -Tenant $Tenant
39-
}
36+
4037

4138
# Get state value using null-coalescing operator
4239
$state = $Settings.state.value ?? $Settings.state
@@ -87,4 +84,14 @@ function Invoke-CIPPStandardPWcompanionAppAllowedState {
8784
Write-LogMessage -API 'Standards' -tenant $Tenant -message 'companionAppAllowedState is not enabled.' -sev Info
8885
}
8986
}
87+
88+
if ($Settings.report -eq $true) {
89+
Add-CIPPBPAField -FieldName 'companionAppAllowedState' -FieldValue $authState -StoreAs bool -Tenant $Tenant
90+
if ($authState) {
91+
$FieldValue = $true
92+
} else {
93+
$FieldValue = $authenticatorFeaturesState.featureSettings
94+
}
95+
Set-CIPPStandardsCompareField -FieldName 'standards.PWcompanionAppAllowedState' -FieldValue $FieldValue -Tenant $Tenant
96+
}
9097
}

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -30,14 +30,13 @@ function Invoke-CIPPStandardPWdisplayAppInformationRequiredState {
3030
#>
3131

3232
param($Tenant, $Settings)
33-
##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'PWdisplayAppInformationRequiredState'
3433

3534
$CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/microsoftAuthenticator' -tenantid $Tenant
36-
$StateIsCorrect = ($CurrentState.state -eq 'enabled') -and
37-
($CurrentState.featureSettings.numberMatchingRequiredState.state -eq 'enabled') -and
38-
($CurrentState.featureSettings.displayAppInformationRequiredState.state -eq 'enabled')
35+
$StateIsCorrect = ($CurrentState.state -eq 'enabled') -and
36+
($CurrentState.featureSettings.numberMatchingRequiredState.state -eq 'enabled') -and
37+
($CurrentState.featureSettings.displayAppInformationRequiredState.state -eq 'enabled')
3938

40-
If ($Settings.remediate -eq $true) {
39+
if ($Settings.remediate -eq $true) {
4140
if ($StateIsCorrect -eq $true) {
4241
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Passwordless with Information and Number Matching is already enabled.' -sev Info
4342
} else {
@@ -52,12 +51,18 @@ function Invoke-CIPPStandardPWdisplayAppInformationRequiredState {
5251
if ($StateIsCorrect -eq $true) {
5352
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Passwordless with Information and Number Matching is enabled.' -sev Info
5453
} else {
55-
Write-StandardsAlert -message "Passwordless with Information and Number Matching is not enabled" -object $CurrentState -tenant $tenant -standardName 'PWdisplayAppInformationRequiredState' -standardId $Settings.standardId
54+
Write-StandardsAlert -message 'Passwordless with Information and Number Matching is not enabled' -object $CurrentState -tenant $tenant -standardName 'PWdisplayAppInformationRequiredState' -standardId $Settings.standardId
5655
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Passwordless with Information and Number Matching is not enabled.' -sev Info
5756
}
5857
}
5958

6059
if ($Settings.report -eq $true) {
6160
Add-CIPPBPAField -FieldName 'PWdisplayAppInformationRequiredState' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
61+
if ($StateIsCorrect) {
62+
$FieldValue = $true
63+
} else {
64+
$FieldValue = $CurrentState
65+
}
66+
Set-CIPPStandardsCompareField -FieldName 'standards.PWdisplayAppInformationRequiredState' -FieldValue $FieldValue -Tenant $tenant
6267
}
6368
}

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardQuarantineRequestAlert.ps1‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,13 +29,12 @@ function Invoke-CIPPStandardQuarantineRequestAlert {
2929
#>
3030

3131
param ($Tenant, $Settings)
32-
##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'QuarantineRequestAlert'
3332

3433
$PolicyName = 'CIPP User requested to release a quarantined message'
3534

3635
$CurrentState = New-ExoRequest -TenantId $Tenant -cmdlet 'Get-ProtectionAlert' -Compliance |
37-
Where-Object { $_.Name -eq $PolicyName } |
38-
Select-Object -Property *
36+
Where-Object { $_.Name -eq $PolicyName } |
37+
Select-Object -Property *
3938

4039
$StateIsCorrect = ($CurrentState.NotifyUser -contains $Settings.NotifyUser)
4140

@@ -85,5 +84,12 @@ function Invoke-CIPPStandardQuarantineRequestAlert {
8584

8685
if ($Settings.report -eq $true) {
8786
Add-CIPPBPAField -FieldName 'QuarantineRequestAlert' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
87+
88+
if ($StateIsCorrect) {
89+
$FieldValue = $true
90+
} else {
91+
$FieldValue = $CurrentState
92+
}
93+
Set-CIPPStandardsCompareField -FieldName 'standards.QuarantineRequestAlert' -FieldValue $FieldValue -Tenant $Tenant
8894
}
8995
}

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardRetentionPolicyTag.ps1‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@ function Invoke-CIPPStandardRetentionPolicyTag {
2929
#>
3030

3131
param($Tenant, $Settings)
32-
##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'RetentionPolicyTag'
3332

3433
$PolicyName = 'CIPP Deleted Items'
3534
$CurrentState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-RetentionPolicyTag' |
@@ -39,11 +38,11 @@ function Invoke-CIPPStandardRetentionPolicyTag {
3938
Where-Object -Property Identity -EQ 'Default MRM Policy'
4039

4140
$StateIsCorrect = ($CurrentState.Name -eq $PolicyName) -and
42-
($CurrentState.RetentionEnabled -eq $true) -and
43-
($CurrentState.RetentionAction -eq 'PermanentlyDelete') -and
44-
($CurrentState.AgeLimitForRetention -eq ([timespan]::FromDays($Settings.AgeLimitForRetention))) -and
45-
($CurrentState.Type -eq 'DeletedItems') -and
46-
($PolicyState.RetentionPolicyTagLinks -contains $PolicyName)
41+
($CurrentState.RetentionEnabled -eq $true) -and
42+
($CurrentState.RetentionAction -eq 'PermanentlyDelete') -and
43+
($CurrentState.AgeLimitForRetention -eq ([timespan]::FromDays($Settings.AgeLimitForRetention))) -and
44+
($CurrentState.Type -eq 'DeletedItems') -and
45+
($PolicyState.RetentionPolicyTagLinks -contains $PolicyName)
4746

4847
if ($Settings.remediate -eq $true) {
4948
Write-Host 'Time to remediate'
@@ -102,13 +101,20 @@ function Invoke-CIPPStandardRetentionPolicyTag {
102101
if ($StateIsCorrect -eq $true) {
103102
Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Retention Policy is enabled' -sev Info
104103
} else {
105-
Write-StandardsAlert -message "Retention Policy is not enabled" -object $CurrentState -tenant $Tenant -standardName 'RetentionPolicyTag' -standardId $Settings.standardId
104+
Write-StandardsAlert -message 'Retention Policy is not enabled' -object $CurrentState -tenant $Tenant -standardName 'RetentionPolicyTag' -standardId $Settings.standardId
106105
Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Retention Policy is not enabled' -sev Info
107106
}
108107
}
109108

110109
if ($Settings.report -eq $true) {
111110
Add-CIPPBPAField -FieldName 'RetentionPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
111+
112+
if ($StateIsCorrect) {
113+
$FieldValue = $true
114+
} else {
115+
$FieldValue = $CurrentState
116+
}
117+
Set-CIPPStandardsCompareField -FieldName 'standards.RetentionPolicyTag' -FieldValue $FieldValue -Tenant $Tenant
112118
}
113119

114120
}

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardRotateDKIM.ps1‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,10 @@ function Invoke-CIPPStandardRotateDKIM {
3131
#>
3232

3333
param($Tenant, $Settings)
34-
##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'RotateDKIM'
3534

36-
$DKIM = (New-ExoRequest -tenantid $tenant -cmdlet 'Get-DkimSigningConfig') | Where-Object { $_.Selector1KeySize -Eq 1024 -and $_.Enabled -eq $true }
35+
$DKIM = (New-ExoRequest -tenantid $tenant -cmdlet 'Get-DkimSigningConfig') | Where-Object { $_.Selector1KeySize -eq 1024 -and $_.Enabled -eq $true }
3736

38-
If ($Settings.remediate -eq $true) {
37+
if ($Settings.remediate -eq $true) {
3938

4039
if ($DKIM) {
4140
$DKIM | ForEach-Object {
@@ -64,5 +63,10 @@ function Invoke-CIPPStandardRotateDKIM {
6463

6564
if ($Settings.report -eq $true) {
6665
Add-CIPPBPAField -FieldName 'DKIM' -FieldValue $DKIM -StoreAs json -Tenant $tenant
66+
if ($DKIM) {
67+
Set-CIPPStandardsCompareField -FieldName 'standards.RotateDKIM' -FieldValue $DKIM -Tenant $tenant
68+
} else {
69+
Set-CIPPStandardsCompareField -FieldName 'standards.RotateDKIM' -FieldValue $true -Tenant $tenant
70+
}
6771
}
6872
}

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1‎

Lines changed: 23 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -37,21 +37,20 @@ function Invoke-CIPPStandardSafeAttachmentPolicy {
3737
#>
3838

3939
param($Tenant, $Settings)
40-
##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'SafeAttachmentPolicy'
4140

4241
$ServicePlans = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/subscribedSkus?$select=servicePlans' -tenantid $Tenant
4342
$ServicePlans = $ServicePlans.servicePlans.servicePlanName
44-
$MDOLicensed = $ServicePlans -contains "ATP_ENTERPRISE"
43+
$MDOLicensed = $ServicePlans -contains 'ATP_ENTERPRISE'
4544

4645
if ($MDOLicensed) {
47-
$PolicyList = @('CIPP Default Safe Attachment Policy','Default Safe Attachment Policy')
46+
$PolicyList = @('CIPP Default Safe Attachment Policy', 'Default Safe Attachment Policy')
4847
$ExistingPolicy = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-SafeAttachmentPolicy' | Where-Object -Property Name -In $PolicyList
4948
if ($null -eq $ExistingPolicy.Name) {
5049
$PolicyName = $PolicyList[0]
5150
} else {
5251
$PolicyName = $ExistingPolicy.Name
5352
}
54-
$RuleList = @( 'CIPP Default Safe Attachment Rule','CIPP Default Safe Attachment Policy')
53+
$RuleList = @( 'CIPP Default Safe Attachment Rule', 'CIPP Default Safe Attachment Policy')
5554
$ExistingRule = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-SafeAttachmentRule' | Where-Object -Property Name -In $RuleList
5655
if ($null -eq $ExistingRule.Name) {
5756
$RuleName = $RuleList[0]
@@ -64,11 +63,11 @@ function Invoke-CIPPStandardSafeAttachmentPolicy {
6463
Select-Object Name, Enable, Action, QuarantineTag, Redirect, RedirectAddress
6564

6665
$StateIsCorrect = ($CurrentState.Name -eq $PolicyName) -and
67-
($CurrentState.Enable -eq $true) -and
68-
($CurrentState.Action -eq $Settings.SafeAttachmentAction) -and
69-
($CurrentState.QuarantineTag -eq $Settings.QuarantineTag) -and
70-
($CurrentState.Redirect -eq $Settings.Redirect) -and
71-
(($null -eq $Settings.RedirectAddress) -or ($CurrentState.RedirectAddress -eq $Settings.RedirectAddress))
66+
($CurrentState.Enable -eq $true) -and
67+
($CurrentState.Action -eq $Settings.SafeAttachmentAction) -and
68+
($CurrentState.QuarantineTag -eq $Settings.QuarantineTag) -and
69+
($CurrentState.Redirect -eq $Settings.Redirect) -and
70+
(($null -eq $Settings.RedirectAddress) -or ($CurrentState.RedirectAddress -eq $Settings.RedirectAddress))
7271

7372
$AcceptedDomains = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-AcceptedDomain'
7473

@@ -77,9 +76,9 @@ function Invoke-CIPPStandardSafeAttachmentPolicy {
7776
Select-Object Name, SafeAttachmentPolicy, Priority, RecipientDomainIs
7877

7978
$RuleStateIsCorrect = ($RuleState.Name -eq $RuleName) -and
80-
($RuleState.SafeAttachmentPolicy -eq $PolicyName) -and
81-
($RuleState.Priority -eq 0) -and
82-
(!(Compare-Object -ReferenceObject $RuleState.RecipientDomainIs -DifferenceObject $AcceptedDomains.Name))
79+
($RuleState.SafeAttachmentPolicy -eq $PolicyName) -and
80+
($RuleState.Priority -eq 0) -and
81+
(!(Compare-Object -ReferenceObject $RuleState.RecipientDomainIs -DifferenceObject $AcceptedDomains.Name))
8382

8483
if ($Settings.remediate -eq $true) {
8584

@@ -115,8 +114,8 @@ function Invoke-CIPPStandardSafeAttachmentPolicy {
115114

116115
if ($RuleStateIsCorrect -eq $false) {
117116
$cmdparams = @{
118-
Priority = 0
119-
RecipientDomainIs = $AcceptedDomains.Name
117+
Priority = 0
118+
RecipientDomainIs = $AcceptedDomains.Name
120119
}
121120

122121
if ($RuleState.SafeAttachmentPolicy -ne $PolicyName) {
@@ -148,26 +147,33 @@ function Invoke-CIPPStandardSafeAttachmentPolicy {
148147
if ($StateIsCorrect -eq $true) {
149148
Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Safe Attachment Policy is enabled' -sev Info
150149
} else {
151-
Write-StandardsAlert -message "Safe Attachment Policy is not enabled" -object $CurrentState -tenant $Tenant -standardName 'SafeAttachmentPolicy' -standardId $Settings.standardId
150+
Write-StandardsAlert -message 'Safe Attachment Policy is not enabled' -object $CurrentState -tenant $Tenant -standardName 'SafeAttachmentPolicy' -standardId $Settings.standardId
152151
Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Safe Attachment Policy is not enabled' -sev Info
153152
}
154153
}
155154

156155
if ($Settings.report -eq $true) {
157156
Add-CIPPBPAField -FieldName 'SafeAttachmentPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
157+
if ($StateIsCorrect) {
158+
$FieldValue = $true
159+
} else {
160+
$FieldValue = $CurrentState
161+
}
162+
Set-CIPPStandardsCompareField -FieldName 'standards.SafeAttachmentPolicy' -FieldValue $FieldValue -Tenant $Tenant
158163
}
159164
} else {
160165
if ($Settings.remediate -eq $true) {
161-
Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to create Safe Attachment policy: Tenant does not have Microsoft Defender for Office 365 license" -sev Error
166+
Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Failed to create Safe Attachment policy: Tenant does not have Microsoft Defender for Office 365 license' -sev Error
162167
}
163168

164169
if ($Settings.alert -eq $true) {
165-
Write-StandardsAlert -message "Safe Attachment Policy is not enabled: Tenant does not have Microsoft Defender for Office 365 license" -object $MDOLicensed -tenant $Tenant -standardName 'SafeAttachmentPolicy' -standardId $Settings.standardId
170+
Write-StandardsAlert -message 'Safe Attachment Policy is not enabled: Tenant does not have Microsoft Defender for Office 365 license' -object $MDOLicensed -tenant $Tenant -standardName 'SafeAttachmentPolicy' -standardId $Settings.standardId
166171
Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Safe Attachment Policy is not enabled: Tenant does not have Microsoft Defender for Office 365 license' -sev Info
167172
}
168173

169174
if ($Settings.report -eq $true) {
170175
Add-CIPPBPAField -FieldName 'SafeAttachmentPolicy' -FieldValue $false -StoreAs bool -Tenant $tenant
176+
Set-CIPPStandardsCompareField -FieldName 'standards.SafeAttachmentPolicy' -FieldValue $false -Tenant $Tenant
171177
}
172178
}
173179
}

0 commit comments

Comments
 (0)