Skip to content

Commit 97f1ac6

Browse files
KelvinTegelaarKelvinTegelaar
committed
More tests
1 parent 020776a commit 97f1ac6

10 files changed

+618
-11
lines changed

‎Modules/CIPPCore/Public/Set-CIPPDBCacheIntunePolicies.ps1‎

Lines changed: 31 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -23,23 +23,43 @@ function Set-CIPPDBCacheIntunePolicies {
2323
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Intune policies' -sev Info
2424

2525
$PolicyTypes = @(
26-
@{ Type = 'DeviceCompliancePolicies'; Uri = 'https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies?$top=999' }
27-
@{ Type = 'DeviceConfigurations'; Uri = 'https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations?$top=999' }
28-
@{ Type = 'ConfigurationPolicies'; Uri = 'https://graph.microsoft.com/beta/deviceManagement/configurationPolicies?$top=999' }
29-
@{ Type = 'GroupPolicyConfigurations'; Uri = 'https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations?$top=999' }
30-
@{ Type = 'MobileAppConfigurations'; Uri = 'https://graph.microsoft.com/beta/deviceManagement/mobileAppConfigurations?$top=999' }
31-
@{ Type = 'AppProtectionPolicies'; Uri = 'https://graph.microsoft.com/beta/deviceAppManagement/managedAppPolicies?$top=999' }
32-
@{ Type = 'WindowsAutopilotDeploymentProfiles'; Uri = 'https://graph.microsoft.com/beta/deviceManagement/windowsAutopilotDeploymentProfiles?$top=999' }
33-
@{ Type = 'DeviceEnrollmentConfigurations'; Uri = 'https://graph.microsoft.com/beta/deviceManagement/deviceEnrollmentConfigurations?$top=999' }
34-
@{ Type = 'DeviceManagementScripts'; Uri = 'https://graph.microsoft.com/beta/deviceManagement/deviceManagementScripts?$top=999' }
35-
@{ Type = 'MobileApps'; Uri = 'https://graph.microsoft.com/beta/deviceAppManagement/mobileApps?$top=999' }
26+
@{ Type = 'DeviceCompliancePolicies'; Uri = 'https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies'; SupportsExpand = $true }
27+
@{ Type = 'DeviceConfigurations'; Uri = 'https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations'; SupportsExpand = $true }
28+
@{ Type = 'ConfigurationPolicies'; Uri = 'https://graph.microsoft.com/beta/deviceManagement/configurationPolicies'; SupportsExpand = $true; ExpandSettings = $true }
29+
@{ Type = 'GroupPolicyConfigurations'; Uri = 'https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations'; SupportsExpand = $true }
30+
@{ Type = 'MobileAppConfigurations'; Uri = 'https://graph.microsoft.com/beta/deviceManagement/mobileAppConfigurations'; SupportsExpand = $true }
31+
@{ Type = 'AppProtectionPolicies'; Uri = 'https://graph.microsoft.com/beta/deviceAppManagement/managedAppPolicies'; SupportsExpand = $false }
32+
@{ Type = 'WindowsAutopilotDeploymentProfiles'; Uri = 'https://graph.microsoft.com/beta/deviceManagement/windowsAutopilotDeploymentProfiles'; SupportsExpand = $true }
33+
@{ Type = 'DeviceEnrollmentConfigurations'; Uri = 'https://graph.microsoft.com/beta/deviceManagement/deviceEnrollmentConfigurations'; SupportsExpand = $false }
34+
@{ Type = 'DeviceManagementScripts'; Uri = 'https://graph.microsoft.com/beta/deviceManagement/deviceManagementScripts'; SupportsExpand = $true }
35+
@{ Type = 'MobileApps'; Uri = 'https://graph.microsoft.com/beta/deviceAppManagement/mobileApps'; SupportsExpand = $false }
3636
)
3737

3838
foreach ($PolicyType in $PolicyTypes) {
3939
try {
40-
$Policies = New-GraphGetRequest -uri $PolicyType.Uri -tenantid $TenantFilter
40+
$UriWithParams = $PolicyType.Uri + '?$top=999'
41+
if ($PolicyType.SupportsExpand) {
42+
$UriWithParams += '&$expand=assignments'
43+
}
44+
if ($PolicyType.ExpandSettings) {
45+
$UriWithParams += ',settings'
46+
}
47+
48+
$Policies = New-GraphGetRequest -uri $UriWithParams -tenantid $TenantFilter
4149

4250
if ($Policies) {
51+
if (-not $PolicyType.SupportsExpand) {
52+
foreach ($Policy in $Policies) {
53+
try {
54+
$AssignmentUri = "$($PolicyType.Uri)/$($Policy.id)/assignments"
55+
$Assignments = New-GraphGetRequest -uri $AssignmentUri -tenantid $TenantFilter
56+
$Policy | Add-Member -NotePropertyName 'assignments' -NotePropertyValue $Assignments -Force
57+
} catch {
58+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to get assignments for $($Policy.id): $($_.Exception.Message)" -sev Verbose
59+
}
60+
}
61+
}
62+
4363
Add-CIPPDbItem -TenantFilter $TenantFilter -Type "Intune$($PolicyType.Type)" -Data $Policies
4464
Add-CIPPDbItem -TenantFilter $TenantFilter -Type "Intune$($PolicyType.Type)" -Data $Policies -Count
4565
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($Policies.Count) $($PolicyType.Type)" -sev Info

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA24540.ps1‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
function Invoke-CippTestZTNA24540 {
2+
param($Tenant)
3+
4+
try {
5+
$ConfigurationPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneConfigurationPolicies'
6+
if (-not $ConfigurationPolicies) {
7+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24540' -TestType 'Devices' -Status 'Investigate' -ResultMarkdown 'Intune configuration policies not found in database' -Risk 'High' -Name 'Windows Firewall policies protect against unauthorized network access' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Device'
8+
return
9+
}
10+
11+
$FirewallPolicies = $ConfigurationPolicies | Where-Object {
12+
$_.templateReference -and $_.templateReference.templateFamily -eq 'endpointSecurityFirewall'
13+
}
14+
15+
if ($FirewallPolicies.Count -eq 0) {
16+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24540' -TestType 'Devices' -Status 'Failed' -ResultMarkdown 'No Windows Firewall configuration policies found' -Risk 'High' -Name 'Windows Firewall policies protect against unauthorized network access' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Device'
17+
return
18+
}
19+
20+
$AssignedPolicies = $FirewallPolicies | Where-Object {
21+
$_.assignments -and $_.assignments.Count -gt 0
22+
}
23+
24+
if ($AssignedPolicies.Count -gt 0) {
25+
$Status = 'Passed'
26+
$ResultLines = @(
27+
'At least one Windows Firewall policy is created and assigned to a group.'
28+
''
29+
'**Windows Firewall Configuration Policies:**'
30+
''
31+
'| Policy Name | Status | Assignment Count |'
32+
'| :---------- | :----- | :--------------- |'
33+
)
34+
35+
foreach ($Policy in $FirewallPolicies) {
36+
$PolicyStatus = if ($Policy.assignments -and $Policy.assignments.Count -gt 0) {
37+
'✅ Assigned'
38+
} else {
39+
'❌ Not assigned'
40+
}
41+
$AssignmentCount = if ($Policy.assignments) { $Policy.assignments.Count } else { 0 }
42+
$ResultLines += "| $($Policy.name) | $PolicyStatus | $AssignmentCount |"
43+
}
44+
45+
$Result = $ResultLines -join "`n"
46+
} else {
47+
$Status = 'Failed'
48+
$ResultLines = @(
49+
'There are no firewall policies assigned to any groups.'
50+
''
51+
'**Windows Firewall Configuration Policies (Unassigned):**'
52+
''
53+
)
54+
55+
foreach ($Policy in $FirewallPolicies) {
56+
$ResultLines += "- $($Policy.name)"
57+
}
58+
59+
$Result = $ResultLines -join "`n"
60+
}
61+
62+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24540' -TestType 'Devices' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Windows Firewall policies protect against unauthorized network access' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Device'
63+
} catch {
64+
$ErrorMessage = Get-CippException -Exception $_
65+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
66+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24540' -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Windows Firewall policies protect against unauthorized network access' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Device'
67+
}
68+
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA24550.ps1‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
function Invoke-CippTestZTNA24550 {
2+
param($Tenant)
3+
4+
try {
5+
$ConfigurationPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneConfigurationPolicies'
6+
if (-not $ConfigurationPolicies) {
7+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24550' -TestType 'Devices' -Status 'Investigate' -ResultMarkdown 'Intune configuration policies not found in database' -Risk 'High' -Name 'Data on Windows is protected by BitLocker encryption' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
8+
return
9+
}
10+
11+
$WindowsPolicies = $ConfigurationPolicies | Where-Object {
12+
$_.platforms -match 'windows10'
13+
}
14+
15+
$WindowsBitLockerPolicies = @()
16+
foreach ($WindowsPolicy in $WindowsPolicies) {
17+
$ValidSettingValues = @('device_vendor_msft_bitlocker_requiredeviceencryption_1')
18+
19+
if ($WindowsPolicy.settings.settinginstance.choicesettingvalue.value) {
20+
$PolicySettingValues = $WindowsPolicy.settings.settinginstance.choicesettingvalue.value
21+
if ($PolicySettingValues -isnot [array]) {
22+
$PolicySettingValues = @($PolicySettingValues)
23+
}
24+
25+
$HasValidSetting = $false
26+
foreach ($SettingValue in $PolicySettingValues) {
27+
if ($ValidSettingValues -contains $SettingValue) {
28+
$HasValidSetting = $true
29+
break
30+
}
31+
}
32+
33+
if ($HasValidSetting) {
34+
$WindowsBitLockerPolicies += $WindowsPolicy
35+
}
36+
}
37+
}
38+
39+
$AssignedPolicies = $WindowsBitLockerPolicies | Where-Object {
40+
$_.assignments -and $_.assignments.Count -gt 0
41+
}
42+
43+
if ($AssignedPolicies.Count -gt 0) {
44+
$Status = 'Passed'
45+
$ResultLines = @(
46+
"At least one Windows BitLocker policy is configured and assigned."
47+
''
48+
"**Windows BitLocker Policies:**"
49+
''
50+
"| Policy Name | Status | Assignment Count |"
51+
"| :---------- | :----- | :--------------- |"
52+
)
53+
54+
foreach ($Policy in $WindowsBitLockerPolicies) {
55+
$PolicyStatus = if ($Policy.assignments -and $Policy.assignments.Count -gt 0) {
56+
'✅ Assigned'
57+
} else {
58+
'❌ Not assigned'
59+
}
60+
$AssignmentCount = if ($Policy.assignments) { $Policy.assignments.Count } else { 0 }
61+
$ResultLines += "| $($Policy.name) | $PolicyStatus | $AssignmentCount |"
62+
}
63+
64+
$Result = $ResultLines -join "`n"
65+
}
66+
else {
67+
$Status = 'Failed'
68+
if ($WindowsBitLockerPolicies.Count -gt 0) {
69+
$ResultLines = @(
70+
"Windows BitLocker policies exist but none are assigned."
71+
''
72+
"**Unassigned BitLocker Policies:**"
73+
''
74+
)
75+
foreach ($Policy in $WindowsBitLockerPolicies) {
76+
$ResultLines += "- $($Policy.name)"
77+
}
78+
}
79+
else {
80+
$ResultLines = @("No Windows BitLocker policy is configured or assigned.")
81+
}
82+
$Result = $ResultLines -join "`n"
83+
}
84+
85+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24550' -TestType 'Devices' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Data on Windows is protected by BitLocker encryption' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
86+
}
87+
catch {
88+
$ErrorMessage = Get-CippException -Exception $_
89+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
90+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24550' -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Data on Windows is protected by BitLocker encryption' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
91+
}
92+
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA24552.ps1‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
function Invoke-CippTestZTNA24552 {
2+
param($Tenant)
3+
4+
try {
5+
$ConfigurationPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneConfigurationPolicies'
6+
if (-not $ConfigurationPolicies) {
7+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24552' -TestType 'Devices' -Status 'Investigate' -ResultMarkdown 'Intune configuration policies not found in database' -Risk 'High' -Name 'Data on macOS is protected by firewall' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
8+
return
9+
}
10+
11+
$MacOSPolicies = $ConfigurationPolicies | Where-Object {
12+
$_.platforms -match 'macOS'
13+
}
14+
15+
$MacOSFirewallPolicies = @()
16+
foreach ($MacOSPolicy in $MacOSPolicies) {
17+
$ValidSettingValues = @('com.apple.security.firewall_enablefirewall_true')
18+
19+
if ($MacOSPolicy.settings.settinginstance.choicesettingvalue.value) {
20+
$PolicySettingValues = $MacOSPolicy.settings.settinginstance.choicesettingvalue.value
21+
if ($PolicySettingValues -isnot [array]) {
22+
$PolicySettingValues = @($PolicySettingValues)
23+
}
24+
25+
$HasValidSetting = $false
26+
foreach ($SettingValue in $PolicySettingValues) {
27+
if ($ValidSettingValues -contains $SettingValue) {
28+
$HasValidSetting = $true
29+
break
30+
}
31+
}
32+
33+
if ($HasValidSetting) {
34+
$MacOSFirewallPolicies += $MacOSPolicy
35+
}
36+
}
37+
}
38+
39+
$AssignedPolicies = $MacOSFirewallPolicies | Where-Object {
40+
$_.assignments -and $_.assignments.Count -gt 0
41+
}
42+
43+
if ($AssignedPolicies.Count -gt 0) {
44+
$Status = 'Passed'
45+
$ResultLines = @(
46+
'At least one macOS Firewall policy is configured and assigned.'
47+
''
48+
'**macOS Firewall Policies:**'
49+
''
50+
'| Policy Name | Status | Assignment Count |'
51+
'| :---------- | :----- | :--------------- |'
52+
)
53+
54+
foreach ($Policy in $MacOSFirewallPolicies) {
55+
$PolicyStatus = if ($Policy.assignments -and $Policy.assignments.Count -gt 0) {
56+
'✅ Assigned'
57+
} else {
58+
'❌ Not assigned'
59+
}
60+
$AssignmentCount = if ($Policy.assignments) { $Policy.assignments.Count } else { 0 }
61+
$ResultLines += "| $($Policy.name) | $PolicyStatus | $AssignmentCount |"
62+
}
63+
64+
$Result = $ResultLines -join "`n"
65+
} else {
66+
$Status = 'Failed'
67+
if ($MacOSFirewallPolicies.Count -gt 0) {
68+
$ResultLines = @(
69+
'macOS Firewall policies exist but none are assigned.'
70+
''
71+
'**Unassigned Firewall Policies:**'
72+
''
73+
)
74+
foreach ($Policy in $MacOSFirewallPolicies) {
75+
$ResultLines += "- $($Policy.name)"
76+
}
77+
} else {
78+
$ResultLines = @('No macOS Firewall policy is configured or assigned.')
79+
}
80+
$Result = $ResultLines -join "`n"
81+
}
82+
83+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24552' -TestType 'Devices' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Data on macOS is protected by firewall' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
84+
} catch {
85+
$ErrorMessage = Get-CippException -Exception $_
86+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
87+
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24552' -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Data on macOS is protected by firewall' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
88+
}
89+
}

0 commit comments

Comments
 (0)