Skip to content

Commit ac7a4dc

Browse files
KelvinTegelaarKelvinTegelaar
committed
remove backtics, mark as tested.
1 parent c9cb112 commit ac7a4dc

13 files changed

+540
-212
lines changed

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA21883.ps1‎

Lines changed: 40 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -17,17 +17,25 @@ function Invoke-CippTestZTNA21883 {
1717
[Parameter(Mandatory = $true)]
1818
[string]$Tenant
1919
)
20-
20+
#tested
2121
try {
2222
# Get Conditional Access policies from cache
2323
$Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
2424

2525
if (-not $Policies) {
26-
Add-CippTestResult -TestId 'ZTNA21883' -TenantFilter $Tenant -TestType 'ZeroTrustNetworkAccess' -Status 'Skipped' `
27-
-ResultMarkdown 'No Conditional Access policies found in cache.' `
28-
-Risk 'Medium' -Name 'Workload identities configured with risk-based policies' `
29-
-UserImpact 'High' -ImplementationEffort 'Low' `
30-
-Category 'Access control'
26+
$TestParams = @{
27+
TestId = 'ZTNA21883'
28+
TenantFilter = $Tenant
29+
TestType = 'ZeroTrustNetworkAccess'
30+
Status = 'Skipped'
31+
ResultMarkdown = 'No Conditional Access policies found in cache.'
32+
Risk = 'Medium'
33+
Name = 'Workload identities configured with risk-based policies'
34+
UserImpact = 'High'
35+
ImplementationEffort = 'Low'
36+
Category = 'Access control'
37+
}
38+
Add-CippTestResult @TestParams
3139
return
3240
}
3341

@@ -92,18 +100,34 @@ function Invoke-CippTestZTNA21883 {
92100
$ResultMarkdown += 'Workload identities should be protected by policies that block authentication when service principal risk is detected.'
93101
}
94102

95-
Add-CippTestResult -TestId 'ZTNA21883' -TenantFilter $Tenant -TestType 'ZeroTrustNetworkAccess' -Status $Status `
96-
-ResultMarkdown $ResultMarkdown `
97-
-Risk 'Medium' -Name 'Workload identities configured with risk-based policies' `
98-
-UserImpact 'High' -ImplementationEffort 'Low' `
99-
-Category 'Access control'
103+
$TestParams = @{
104+
TestId = 'ZTNA21883'
105+
TenantFilter = $Tenant
106+
TestType = 'ZeroTrustNetworkAccess'
107+
Status = $Status
108+
ResultMarkdown = $ResultMarkdown
109+
Risk = 'Medium'
110+
Name = 'Workload identities configured with risk-based policies'
111+
UserImpact = 'High'
112+
ImplementationEffort = 'Low'
113+
Category = 'Access control'
114+
}
115+
Add-CippTestResult @TestParams
100116

101117
} catch {
102-
Add-CippTestResult -TestId 'ZTNA21883' -TenantFilter $Tenant -TestType 'ZeroTrustNetworkAccess' -Status 'Failed' `
103-
-ResultMarkdown "❌ **Error**: $($_.Exception.Message)" `
104-
-Risk 'Medium' -Name 'Workload identities configured with risk-based policies' `
105-
-UserImpact 'High' -ImplementationEffort 'Low' `
106-
-Category 'Access control'
118+
$TestParams = @{
119+
TestId = 'ZTNA21883'
120+
TenantFilter = $Tenant
121+
TestType = 'ZeroTrustNetworkAccess'
122+
Status = 'Failed'
123+
ResultMarkdown = "❌ **Error**: $($_.Exception.Message)"
124+
Risk = 'Medium'
125+
Name = 'Workload identities configured with risk-based policies'
126+
UserImpact = 'High'
127+
ImplementationEffort = 'Low'
128+
Category = 'Access control'
129+
}
130+
Add-CippTestResult @TestParams
107131
Write-LogMessage -API 'ZeroTrustNetworkAccess' -tenant $Tenant -message "Test ZTNA21883 failed: $($_.Exception.Message)" -sev Error
108132
}
109133
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA21886.ps1‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
function Invoke-CippTestZTNA21886 {
22
param($Tenant)
3-
3+
#Tested
44
try {
55
$ServicePrincipals = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ServicePrincipals'
66
if (-not $ServicePrincipals) {
@@ -29,7 +29,7 @@ function Invoke-CippTestZTNA21886 {
2929

3030
$SSOByType = $AppsWithSSO | Group-Object -Property preferredSingleSignOnMode
3131
foreach ($Group in $SSOByType) {
32-
$ResultLines += ""
32+
$ResultLines += ''
3333
$ResultLines += "**$($Group.Name.ToUpper()) SSO** ($($Group.Count) app(s)):"
3434
$Top5 = $Group.Group | Select-Object -First 5
3535
foreach ($App in $Top5) {

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA21889.ps1‎

Lines changed: 40 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -15,17 +15,25 @@ function Invoke-CippTestZTNA21889 {
1515
[Parameter(Mandatory = $true)]
1616
[string]$Tenant
1717
)
18-
18+
#tested
1919
try {
2020
# Get authentication methods policy from cache
2121
$AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
2222

2323
if (-not $AuthMethodsPolicy) {
24-
Add-CippTestResult -TestId 'ZTNA21889' -TenantFilter $Tenant -TestType 'ZeroTrustNetworkAccess' -Status 'Skipped' `
25-
-ResultMarkdown 'Unable to retrieve authentication methods policy from cache.' `
26-
-Risk 'High' -Name 'Reduce the user-visible password surface area' `
27-
-UserImpact 'Medium' -ImplementationEffort 'Medium' `
28-
-Category 'Access control'
24+
$TestParams = @{
25+
TestId = 'ZTNA21889'
26+
TenantFilter = $Tenant
27+
TestType = 'ZeroTrustNetworkAccess'
28+
Status = 'Skipped'
29+
ResultMarkdown = 'Unable to retrieve authentication methods policy from cache.'
30+
Risk = 'High'
31+
Name = 'Reduce the user-visible password surface area'
32+
UserImpact = 'Medium'
33+
ImplementationEffort = 'Medium'
34+
Category = 'Access control'
35+
}
36+
Add-CippTestResult @TestParams
2937
return
3038
}
3139

@@ -106,18 +114,34 @@ function Invoke-CippTestZTNA21889 {
106114
$AuthStatus = if ($AuthValid) { '✅ Pass' } else { '❌ Fail' }
107115
$ResultMarkdown += "| Microsoft Authenticator | $AuthState | $AuthTargetsDisplay | $AuthModeDisplay | $AuthStatus |`n"
108116

109-
Add-CippTestResult -TestId 'ZTNA21889' -TenantFilter $Tenant -TestType 'ZeroTrustNetworkAccess' -Status $Status `
110-
-ResultMarkdown $ResultMarkdown `
111-
-Risk 'High' -Name 'Reduce the user-visible password surface area' `
112-
-UserImpact 'Medium' -ImplementationEffort 'Medium' `
113-
-Category 'Access control'
117+
$TestParams = @{
118+
TestId = 'ZTNA21889'
119+
TenantFilter = $Tenant
120+
TestType = 'ZeroTrustNetworkAccess'
121+
Status = $Status
122+
ResultMarkdown = $ResultMarkdown
123+
Risk = 'High'
124+
Name = 'Reduce the user-visible password surface area'
125+
UserImpact = 'Medium'
126+
ImplementationEffort = 'Medium'
127+
Category = 'Access control'
128+
}
129+
Add-CippTestResult @TestParams
114130

115131
} catch {
116-
Add-CippTestResult -TestId 'ZTNA21889' -TenantFilter $Tenant -TestType 'ZeroTrustNetworkAccess' -Status 'Failed' `
117-
-ResultMarkdown "❌ **Error**: $($_.Exception.Message)" `
118-
-Risk 'High' -Name 'Reduce the user-visible password surface area' `
119-
-UserImpact 'Medium' -ImplementationEffort 'Medium' `
120-
-Category 'Access control'
132+
$TestParams = @{
133+
TestId = 'ZTNA21889'
134+
TenantFilter = $Tenant
135+
TestType = 'ZeroTrustNetworkAccess'
136+
Status = 'Failed'
137+
ResultMarkdown = "❌ **Error**: $($_.Exception.Message)"
138+
Risk = 'High'
139+
Name = 'Reduce the user-visible password surface area'
140+
UserImpact = 'Medium'
141+
ImplementationEffort = 'Medium'
142+
Category = 'Access control'
143+
}
144+
Add-CippTestResult @TestParams
121145
Write-LogMessage -API 'ZeroTrustNetworkAccess' -tenant $Tenant -message "Test ZTNA21889 failed: $($_.Exception.Message)" -sev Error
122146
}
123147
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA21892.ps1‎

Lines changed: 40 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -18,17 +18,25 @@ function Invoke-CippTestZTNA21892 {
1818
[Parameter(Mandatory = $true)]
1919
[string]$Tenant
2020
)
21-
21+
#tested
2222
try {
2323
# Get Conditional Access policies from cache
2424
$Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
2525

2626
if (-not $Policies) {
27-
Add-CippTestResult -TestId 'ZTNA21892' -TenantFilter $Tenant -TestType 'ZeroTrustNetworkAccess' -Status 'Skipped' `
28-
-ResultMarkdown 'No Conditional Access policies found in cache.' `
29-
-Risk 'High' -Name 'All sign-in activity comes from managed devices' `
30-
-UserImpact 'High' -ImplementationEffort 'High' `
31-
-Category 'Access control'
27+
$TestParams = @{
28+
TestId = 'ZTNA21892'
29+
TenantFilter = $Tenant
30+
TestType = 'ZeroTrustNetworkAccess'
31+
Status = 'Skipped'
32+
ResultMarkdown = 'No Conditional Access policies found in cache.'
33+
Risk = 'High'
34+
Name = 'All sign-in activity comes from managed devices'
35+
UserImpact = 'High'
36+
ImplementationEffort = 'High'
37+
Category = 'Access control'
38+
}
39+
Add-CippTestResult @TestParams
3240
return
3341
}
3442

@@ -112,18 +120,34 @@ function Invoke-CippTestZTNA21892 {
112120
$ResultMarkdown += 'Organizations should enforce that all sign-ins come from managed devices (compliant or hybrid Azure AD joined) to ensure security controls are applied.'
113121
}
114122

115-
Add-CippTestResult -TestId 'ZTNA21892' -TenantFilter $Tenant -TestType 'ZeroTrustNetworkAccess' -Status $Status `
116-
-ResultMarkdown $ResultMarkdown `
117-
-Risk 'High' -Name 'All sign-in activity comes from managed devices' `
118-
-UserImpact 'High' -ImplementationEffort 'High' `
119-
-Category 'Access control'
123+
$TestParams = @{
124+
TestId = 'ZTNA21892'
125+
TenantFilter = $Tenant
126+
TestType = 'ZeroTrustNetworkAccess'
127+
Status = $Status
128+
ResultMarkdown = $ResultMarkdown
129+
Risk = 'High'
130+
Name = 'All sign-in activity comes from managed devices'
131+
UserImpact = 'High'
132+
ImplementationEffort = 'High'
133+
Category = 'Access control'
134+
}
135+
Add-CippTestResult @TestParams
120136

121137
} catch {
122-
Add-CippTestResult -TestId 'ZTNA21892' -TenantFilter $Tenant -TestType 'ZeroTrustNetworkAccess' -Status 'Failed' `
123-
-ResultMarkdown "❌ **Error**: $($_.Exception.Message)" `
124-
-Risk 'High' -Name 'All sign-in activity comes from managed devices' `
125-
-UserImpact 'High' -ImplementationEffort 'High' `
126-
-Category 'Access control'
138+
$TestParams = @{
139+
TestId = 'ZTNA21892'
140+
TenantFilter = $Tenant
141+
TestType = 'ZeroTrustNetworkAccess'
142+
Status = 'Failed'
143+
ResultMarkdown = "❌ **Error**: $($_.Exception.Message)"
144+
Risk = 'High'
145+
Name = 'All sign-in activity comes from managed devices'
146+
UserImpact = 'High'
147+
ImplementationEffort = 'High'
148+
Category = 'Access control'
149+
}
150+
Add-CippTestResult @TestParams
127151
Write-LogMessage -API 'ZeroTrustNetworkAccess' -tenant $Tenant -message "Test ZTNA21892 failed: $($_.Exception.Message)" -sev Error
128152
}
129153
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA21941.ps1‎

Lines changed: 41 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,19 @@ function Invoke-CippTestZTNA21941 {
2222
$CAPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
2323

2424
if (-not $CAPolicies) {
25-
Add-CippTestResult -TestId 'ZTNA21941' -TenantFilter $Tenant -TestType 'ZeroTrustNetworkAccess' -Status 'Skipped' `
26-
-ResultMarkdown 'Unable to retrieve Conditional Access policies from cache.' `
27-
-Risk 'High' -Name 'Implement token protection policies' `
28-
-UserImpact 'Medium' -ImplementationEffort 'Medium' `
29-
-Category 'Access control'
25+
$TestParams = @{
26+
TestId = 'ZTNA21941'
27+
TenantFilter = $Tenant
28+
TestType = 'ZeroTrustNetworkAccess'
29+
Status = 'Skipped'
30+
ResultMarkdown = 'Unable to retrieve Conditional Access policies from cache.'
31+
Risk = 'High'
32+
Name = 'Implement token protection policies'
33+
UserImpact = 'Medium'
34+
ImplementationEffort = 'Medium'
35+
Category = 'Access control'
36+
}
37+
Add-CippTestResult @TestParams
3038
return
3139
}
3240

@@ -38,7 +46,7 @@ function Invoke-CippTestZTNA21941 {
3846

3947
# Filter for policies with Windows platform and secureSignInSession control
4048
$TokenProtectionPolicies = [System.Collections.Generic.List[object]]::new()
41-
49+
4250
foreach ($policy in $CAPolicies) {
4351
# Check if policy has Windows platform
4452
$hasWindows = $false
@@ -144,25 +152,41 @@ function Invoke-CippTestZTNA21941 {
144152
$usersIcon = if ($policy.HasUsers) { '✅' } else { '❌' }
145153
$appsIcon = if ($policy.HasRequiredApps) { '✅' } else { '❌' }
146154
$statusIcon = if ($policy.Status -eq 'Pass') { '✅' } else { '❌' }
147-
155+
148156
$ResultMarkdown += "| $($policy.Name) | $stateIcon $($policy.State) | $usersIcon | $appsIcon | $statusIcon $($policy.Status) |`n"
149157
}
150158

151159
$ResultMarkdown += "`n[Review policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies)"
152160
}
153161

154-
Add-CippTestResult -TestId 'ZTNA21941' -TenantFilter $Tenant -TestType 'ZeroTrustNetworkAccess' -Status $Status `
155-
-ResultMarkdown $ResultMarkdown `
156-
-Risk 'High' -Name 'Implement token protection policies' `
157-
-UserImpact 'Medium' -ImplementationEffort 'Medium' `
158-
-Category 'Access control'
162+
$TestParams = @{
163+
TestId = 'ZTNA21941'
164+
TenantFilter = $Tenant
165+
TestType = 'ZeroTrustNetworkAccess'
166+
Status = $Status
167+
ResultMarkdown = $ResultMarkdown
168+
Risk = 'High'
169+
Name = 'Implement token protection policies'
170+
UserImpact = 'Medium'
171+
ImplementationEffort = 'Medium'
172+
Category = 'Access control'
173+
}
174+
Add-CippTestResult @TestParams
159175

160176
} catch {
161-
Add-CippTestResult -TestId 'ZTNA21941' -TenantFilter $Tenant -TestType 'ZeroTrustNetworkAccess' -Status 'Failed' `
162-
-ResultMarkdown "❌ **Error**: $($_.Exception.Message)" `
163-
-Risk 'High' -Name 'Implement token protection policies' `
164-
-UserImpact 'Medium' -ImplementationEffort 'Medium' `
165-
-Category 'Access control'
177+
$TestParams = @{
178+
TestId = 'ZTNA21941'
179+
TenantFilter = $Tenant
180+
TestType = 'ZeroTrustNetworkAccess'
181+
Status = 'Failed'
182+
ResultMarkdown = "❌ **Error**: $($_.Exception.Message)"
183+
Risk = 'High'
184+
Name = 'Implement token protection policies'
185+
UserImpact = 'Medium'
186+
ImplementationEffort = 'Medium'
187+
Category = 'Access control'
188+
}
189+
Add-CippTestResult @TestParams
166190
Write-LogMessage -API 'ZeroTrustNetworkAccess' -tenant $Tenant -message "Test ZTNA21941 failed: $($_.Exception.Message)" -sev Error
167191
}
168192
}

0 commit comments

Comments
 (0)