Skip to content

Commit 749a40d

Browse files
KelvinTegelaarKelvinTegelaar
committed
new tests
1 parent e9a6336 commit 749a40d

File tree

7 files changed

+173
-2
lines changed

7 files changed

+173
-2
lines changed

‎Modules/CIPPCore/Public/Set-CIPPDBCacheGuests.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ function Set-CIPPDBCacheGuests {
1515
try {
1616
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching guest users' -sev Info
1717

18-
$Guests = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users?`$filter=userType eq 'Guest'&`$top=999" -tenantid $TenantFilter
18+
$Guests = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users?`$filter=userType eq 'Guest'&`$expand=sponsors&`$top=999" -tenantid $TenantFilter
1919
Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Guests' -Data $Guests
2020
Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Guests' -Data $Guests -Count
2121
$Guests = $null

‎Modules/CIPPCore/Public/Set-CIPPDBCacheServicePrincipals.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ function Set-CIPPDBCacheServicePrincipals {
1515
try {
1616
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching service principals' -sev Info
1717

18-
$ServicePrincipals = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/servicePrincipals?$top=999&$select=id,appId,displayName,servicePrincipalType,accountEnabled' -tenantid $TenantFilter
18+
$ServicePrincipals = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/servicePrincipals' -tenantid $TenantFilter
1919
Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ServicePrincipals' -Data $ServicePrincipals
2020
Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ServicePrincipals' -Data $ServicePrincipals -Count
2121
$ServicePrincipals = $null

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA21858.ps1‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
function Invoke-CippTestZTNA21858 {
2+
param($Tenant)
3+
4+
try {
5+
$Guests = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Guests'
6+
if (-not $Guests) {
7+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21858' -TestType 'Identity' -Status 'Investigate' -ResultMarkdown 'Guest user data not found in database' -Risk 'Medium' -Name 'Inactive guest identities are disabled or removed from the tenant' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'External collaboration'
8+
return
9+
}
10+
11+
$InactivityThresholdDays = 90
12+
$Today = Get-Date
13+
$EnabledGuests = $Guests | Where-Object { $_.AccountEnabled -eq $true }
14+
15+
if (-not $EnabledGuests) {
16+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21858' -TestType 'Identity' -Status 'Passed' -ResultMarkdown 'No guest users found in the tenant' -Risk 'Medium' -Name 'Inactive guest identities are disabled or removed from the tenant' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'External collaboration'
17+
return
18+
}
19+
20+
$InactiveGuests = @()
21+
foreach ($Guest in $EnabledGuests) {
22+
$DaysSinceLastActivity = $null
23+
24+
if ($Guest.signInActivity.lastSuccessfulSignInDateTime) {
25+
$LastSignIn = [DateTime]$Guest.signInActivity.lastSuccessfulSignInDateTime
26+
$DaysSinceLastActivity = ($Today - $LastSignIn).Days
27+
} elseif ($Guest.createdDateTime) {
28+
$Created = [DateTime]$Guest.createdDateTime
29+
$DaysSinceLastActivity = ($Today - $Created).Days
30+
}
31+
32+
if ($null -ne $DaysSinceLastActivity -and $DaysSinceLastActivity -gt $InactivityThresholdDays) {
33+
$InactiveGuests += $Guest
34+
}
35+
}
36+
37+
if ($InactiveGuests.Count -gt 0) {
38+
$Status = 'Failed'
39+
$Result = "Found $($InactiveGuests.Count) inactive guest user(s) with no sign-in activity in the last $InactivityThresholdDays days"
40+
} else {
41+
$Status = 'Passed'
42+
$Result = "All enabled guest users have been active within the last $InactivityThresholdDays days"
43+
}
44+
45+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21858' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Inactive guest identities are disabled or removed from the tenant' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'External collaboration'
46+
} catch {
47+
$ErrorMessage = Get-CippException -Exception $_
48+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
49+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21858' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Inactive guest identities are disabled or removed from the tenant' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'External collaboration'
50+
}
51+
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA21868.ps1‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
function Invoke-CippTestZTNA21868 {
2+
param($Tenant)
3+
4+
try {
5+
$Guests = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Guests'
6+
$Apps = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Apps'
7+
$ServicePrincipals = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ServicePrincipals'
8+
9+
if (-not $Guests -or -not $Apps -or -not $ServicePrincipals) {
10+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21868' -TestType 'Identity' -Status 'Investigate' -ResultMarkdown 'Required data not found in database' -Risk 'Medium' -Name 'Guests do not own apps in the tenant' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'External collaboration'
11+
return
12+
}
13+
14+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21868' -TestType 'Identity' -Status 'Investigate' -ResultMarkdown 'This test requires Graph API calls to check application and service principal ownership. Owner relationships are not cached.' -Risk 'Medium' -Name 'Guests do not own apps in the tenant' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'External collaboration'
15+
}
16+
catch {
17+
$ErrorMessage = Get-CippException -Exception $_
18+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
19+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21868' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Guests do not own apps in the tenant' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'External collaboration'
20+
}
21+
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA21869.ps1‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
function Invoke-CippTestZTNA21869 {
2+
param($Tenant)
3+
4+
try {
5+
$ServicePrincipals = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ServicePrincipals'
6+
if (-not $ServicePrincipals) {
7+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21869' -TestType 'Identity' -Status 'Investigate' -ResultMarkdown 'Service principal data not found in database' -Risk 'Medium' -Name 'Enterprise applications must require explicit assignment or scoped provisioning' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Application management'
8+
return
9+
}
10+
11+
$AppsWithoutAssignment = $ServicePrincipals | Where-Object {
12+
$_.appRoleAssignmentRequired -eq $false -and
13+
$null -ne $_.preferredSingleSignOnMode -and
14+
$_.preferredSingleSignOnMode -in @('password', 'saml', 'oidc') -and
15+
$_.accountEnabled -eq $true
16+
}
17+
18+
if (-not $AppsWithoutAssignment) {
19+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21869' -TestType 'Identity' -Status 'Passed' -ResultMarkdown 'All enterprise applications have explicit assignment requirements' -Risk 'Medium' -Name 'Enterprise applications must require explicit assignment or scoped provisioning' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Application management'
20+
return
21+
}
22+
23+
$Status = 'Investigate'
24+
$Result = "Found $($AppsWithoutAssignment.Count) enterprise application(s) without assignment requirements. Full provisioning scope validation requires Graph API calls not available in cache."
25+
26+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21869' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Enterprise applications must require explicit assignment or scoped provisioning' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Application management'
27+
}
28+
catch {
29+
$ErrorMessage = Get-CippException -Exception $_
30+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
31+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21869' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Enterprise applications must require explicit assignment or scoped provisioning' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Application management'
32+
}
33+
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA21877.ps1‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
function Invoke-CippTestZTNA21877 {
2+
param($Tenant)
3+
4+
try {
5+
$Guests = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Guests'
6+
if (-not $Guests) {
7+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21877' -TestType 'Identity' -Status 'Investigate' -ResultMarkdown 'Guest user data not found in database' -Risk 'Medium' -Name 'All guests have a sponsor' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Application management'
8+
return
9+
}
10+
11+
if ($Guests.Count -eq 0) {
12+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21877' -TestType 'Identity' -Status 'Passed' -ResultMarkdown 'No guest accounts found in the tenant' -Risk 'Medium' -Name 'All guests have a sponsor' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Application management'
13+
return
14+
}
15+
16+
$GuestsWithoutSponsors = $Guests | Where-Object { -not $_.sponsors -or $_.sponsors.Count -eq 0 }
17+
18+
if ($GuestsWithoutSponsors.Count -eq 0) {
19+
$Status = 'Passed'
20+
$Result = 'All guest accounts in the tenant have an assigned sponsor'
21+
}
22+
else {
23+
$Status = 'Failed'
24+
$Result = "Found $($GuestsWithoutSponsors.Count) guest user(s) without sponsors out of $($Guests.Count) total guests"
25+
}
26+
27+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21877' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'All guests have a sponsor' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Application management'
28+
}
29+
catch {
30+
$ErrorMessage = Get-CippException -Exception $_
31+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
32+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21877' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'All guests have a sponsor' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Application management'
33+
}
34+
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA21886.ps1‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
function Invoke-CippTestZTNA21886 {
2+
param($Tenant)
3+
4+
try {
5+
$ServicePrincipals = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ServicePrincipals'
6+
if (-not $ServicePrincipals) {
7+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21886' -TestType 'Identity' -Status 'Investigate' -ResultMarkdown 'Service principal data not found in database' -Risk 'Medium' -Name 'Applications are configured for automatic user provisioning' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Applications management'
8+
return
9+
}
10+
11+
$AppsWithSSO = $ServicePrincipals | Where-Object {
12+
$null -ne $_.preferredSingleSignOnMode -and
13+
$_.preferredSingleSignOnMode -in @('password', 'saml', 'oidc') -and
14+
$_.accountEnabled -eq $true
15+
}
16+
17+
if (-not $AppsWithSSO) {
18+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21886' -TestType 'Identity' -Status 'Passed' -ResultMarkdown 'No applications configured for SSO found' -Risk 'Medium' -Name 'Applications are configured for automatic user provisioning' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Applications management'
19+
return
20+
}
21+
22+
$Status = 'Investigate'
23+
$Result = "Found $($AppsWithSSO.Count) application(s) configured for SSO. Provisioning template and job validation requires Graph API synchronization endpoint not available in cache."
24+
25+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21886' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Applications are configured for automatic user provisioning' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Applications management'
26+
}
27+
catch {
28+
$ErrorMessage = Get-CippException -Exception $_
29+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
30+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21886' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Applications are configured for automatic user provisioning' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Applications management'
31+
}
32+
}

0 commit comments

Comments
 (0)